[Dashboard] filter on first/last seen doesn't work about opencti

[nino-filigran]

@Lhorus6 I cannot say whether or not it was something existing or not, but I'm not sure its a bug:

• using a knowledge perspective, using the attribute "start time" works, both when displaying AND when playing with filters
• using a knowledge perspective, using the attribute "first seen" works partially: it only displays data when date fitlers on the dashboard are not enabled
• using an entity view, displaying incidents and showing the attribute "first seen" works: it shows me 0.

I don't think it's a bug:

• in relations, start time and stop time are used as date attributes
• in sightings, first seen and "last seen" are used as date attributes
• in entities, creation date (technical & functional) are used.

Therefore, to me this is not a bug, but rather a not so good UI, since we offer to display values based on fields that do not exists. I might be wrong, because I have not played a lot with dashboards.
I'm not closing it though, to make sure you can test and ensure that this seems right.

[Lhorus6]

I'm exactly of the same opinion as you. You described exactly what I tried to describe in my issue but with more talent haha ^^

Like you, I don't know if it's a bug, and that's why I ended my issue by saying :
This wouldn't be a bug. However, we have a customer who tells me that it worked before, so I have my doubts. Looking in the code should be able to tell if it's a bug or if it's my assumption that is correct

Would it be possible to have this checked?

[nino-filigran]

Yeah, sure, just asked for it this morning.

[nino-filigran]

@Lhorus6 I confirm: it's because

• in relations, start time and stop time are used as date attributes: therefore, choosing any other attribute won't work
• in sightings, first seen and "last seen" are used as date attributes: therefore, choosing any other attribute won't work
• in entities, creation date (technical & functional) are used: therefore, choosing any other attribute won't work

[nino-filigran]

I'm closing this issue since it's not a bug, but I've created a feature request to ensure we improve which dates are selected according to the context: #7128