Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Playbook] Indicator generated by the playbook not added in the container #9533

Open
Lhorus6 opened this issue Jan 8, 2025 · 3 comments
Open
Labels
bug use for describing something not working as expected playbook Linked to automation engine

Comments

@Lhorus6
Copy link

Lhorus6 commented Jan 8, 2025

Description

When my playbook generates indicators based on Observables contained in a report, it does not add them to the report.

NB: the toggle "If main entity is a container, wrap indicators in container" in the "Promote observable to indicator" component is ON

Environment

6.4.5

Reproducible Steps

Steps to create the smallest reproducible scenario:

Please do that in testing, the playbook is there.

  1. Create a report and add few Observables inside
  2. Click on the button with the three dots to "Enroll in playbook"
  3. Choose the playbook "Test bug indicator in container"
    -> You can see that the indicators are created by the playbook, but not added in the container.
    -> If you look at the execution traces of the playbook, everything seems to work fine, i.e. Indicators appear to be included in the report.

Note: I have a simpler playbook named "Test working". You can test with this one, and you will see that it works. So it's not the component "Promote observable to indicator" which has a problem, it seems rather that something (another component?) is interfering.

Expected Output

I want to have my Indicator generated by my playbook inside my report

Actual Output

The Indicator are generated, but not added in the report

@Lhorus6 Lhorus6 added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Jan 8, 2025
@nino-filigran
Copy link

@Lhorus6 using your "Test bug indicator in container", I get my indicator successfuly created and added to my container. See https://testing.octi.staging.filigran.io/dashboard/analyses/reports/802ffe12-472b-4021-816d-c7e69bf83010

@nino-filigran nino-filigran added needs more info Intel needed about the use case and removed needs triage use to identify issue needing triage from Filigran Product team labels Jan 9, 2025
@Lhorus6
Copy link
Author

Lhorus6 commented Jan 12, 2025

Hi @nino-filigran,
Here your Indicator has not been added by your playbook. It does end up in your report, but that's thanks to an inference rule. You can see this because the relationship line is orange and dashed, and the indicator has an orange outline.

Image

In the list view, you'll notice this thanks to the magic wand icon at the end of the line

Image

You therefore have an indicator and its relationship that are inferred, not added by the playbook. So, the playbook doesn't do its job as expected.

@nino-filigran
Copy link

My bad, I should have checked this. It's clear, thanks @Lhorus6

@nino-filigran nino-filigran added playbook Linked to automation engine and removed needs more info Intel needed about the use case labels Jan 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected playbook Linked to automation engine
Projects
None yet
Development

No branches or pull requests

2 participants