Description

I found a bug in the command sequence API where using include_similar=true actually made the results worse instead of better , it was losing data instead of extending it.

The problem: when I query an IP with include_similar=true, the API was throwing away the exact matches and only returning cluster-based results. If a command sequence had no cluster assigned, I'd get nothing back even though there should be results.

What I Changed

I rewrote lines 69-73 in command_sequence_view to use .union() instead of reassigning the queryset. This matches how
cowrie_session_view already handles the same flag correctly.

Tests

Added two tests to catch this regression:

• One verifies include_similar results include the base results (never lose data)
• One tests the edge case where sequences have no cluster

Fixes #985

Type of change

• Bug fix (non-breaking change which fixes an issue).

Checklist

Formalities

• I have read and understood the rules about how to Contribute to this project.
• I chose an appropriate title for the pull request in the form: <feature name>. Closes #999
• My branch is based on develop.
• The pull request is for the branch develop.
• I have reviewed and verified any LLM-generated code included in this PR.

Docs and tests

• I documented my code changes with docstrings and/or comments.
• I have checked if my changes affect user-facing behavior that is described in the docs. If so, I also created a pull request in the docs repository.
• Linter (Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
• I have added tests for the feature/bug I solved.
• All the tests gave 0 errors.