Skip to content

[ti_misp] integration doesn't work if "event.original" already exists #6730

@frconil

Description

@frconil

Looking at the pipeline definition we do not seem to take into account whether the field already exists.

This causes issues even when "preserve original data" is unchecked after having been previously checked, or if the field already exists in the target index.

I believe this is the same issue than in #3451 or #5334 and adding if: 'ctx.event?.original == null' is what is required here.

Metadata

Metadata

Assignees

Labels

Integration:ti_mispMISPbugSomething isn't working, use only for issues

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions