CSV Mapper default value for boolean fields are not working about opencti

[lndrtrbn]

There is an other strange behavior on this boolean is_family. It is required but not highlighted in red if nothing is configured for it and the mapper is considered valid by the backend. Nonetheless when trying to import data after, the import fails.

@nino-filigran

I'm for fixing this issue in the same time

[lndrtrbn]

To have a bit of context: same component is used between default value in CSV mapper and settings customization.

Indeed we should have false if off and true if on. I think the label of the toggle is misleading as we can understand it as "should we have a default value" instead of "we have a default value, the value is: true/false".

It would be more intuitive (IMO) with something like: Default value: false <toggle> true instead of <toggle> Default value.
Or even a group off two buttons [true|false] instead of a toggle.

[lndrtrbn]

I found the solution yesterday and add it directly in this PR

[labo-flg]

probably a simple if clause on the value to check if it's defined, that just if(value) or something. We must check for undefined/null only if the false value is legit.

[CelineSebe]

"is family" attribute is customizable in settings too:

[lndrtrbn]

@nino-filigran the bug is not only a UI issue. In fact for now we can set only TRUE as default value for boolean attributes, we cannot set FALSE. To do it we need change how we save the default value in elastic (not a big change).

• bug also on Settings > Customization (Example: malware/is family)

[nino-filigran]

So to recap, If I understand correctly,

• currently when toggling on this CTA it basically means "use TRUE as default value".
• However, when toggling off, it means "do not apply a default value".

If so, I agree that it's misleading.
As a result, we should indeed fix it by applying your suggestion Default value: false true

[lndrtrbn]

You understand correctly. Agreed on the fix then 😊

[nino-filigran]

Many thanks for your help @lndrtrbn

[CelineSebe]

EDIT: issues solved
To precise, it is highlighted in red the first time the field is_family is opened, but it isn't red after it is filled and unfilled.

@nino-filigran
Another issue:
The default value for the field name seems to be configured in the CSV mapper and customization, but it isn't.

Has a bug already been reported on this issue?

[lndrtrbn]

@nino-filigran

Find an other issue about the management of boolean values:

• I have set a default value for the boolean attribute in Settings > Customization (for example True for malware.is_family),
• I have created a CSV mapper to map malwares without specifying a default value at CSV mapper level,
• I launch an import of a file where the column is_family has missing data for some malwares.

Expected output: import success with the default value set in Customization.
Actual output: import fails.

[nino-filigran]

@lndrtrbn Do you want me to open a bug for this, or do you tackle this weird behavior as part of this?

[nino-filigran]

Thanks again for your help