Select All Enrichment within a Container will Only Work When a Filter is Applied

[nhuber0724]

Description

When in a container (such as an RFI) within the observables tab, the select all enrichment will only work when a filter is applied, even if there is only one type of observable present (such as artifact).

Environment

OpenCTI v6.5.2

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Open an RFI container and proceed to the observables tab. Select a RFI with only one observable type listed.
2. Select all. The enrichment icon will not show up.
3. Apply a filter to filter on the observables listed.
4. Select all - the enrichment icon will show up.

Expected Output

When at least having all the same observable types listed, the user should be able to select all and enrich without having to apply a filter.

Actual Output

In order to use the select all function to enrich on a single observable type, the user must first apply a filter.

Additional information

Screenshots (optional)

[nino-filigran]

@nhuber0724 I switch this to a feautre, since this beahvior has never been implemented. Indeed, when you select all, the query does not return the fact the list contains the same type of entities (to put it simply, the select all is not "aware" of entity types in the list).
Therefore, that is why you need to select a filter.
I understand it's not a desired behavior, when you only have a single type of observable, but it's the way it's been built.

[Lhorus6]

If I am not mistaken, this is a bug @nino-filigran

We implemented this recently. If you test from a Report, it works. But not from an RFI

[nino-filigran]

I just tried it on testing, and i confirm it does not work:

Indeed, we worked on recently, and we at least needed either the filter on the top or on the right.