[livestream] renaming of observable creates a new one in perfect sync mode

[axelfahy]

Description

When using livestream to replicate data between two instances of opencti, with perfect sync activated, renaming an observable creates a new one instead of renaming it. I supposed this happens when modifying information that changes the ID of the entity, possibly for all entities (not tested).

This might be linked to this previous issue: #8512 which does not fix the following case.

Environment

1. OS (where OpenCTI server runs): docker
2. OpenCTI version: 6.3.11
3. OpenCTI client: frontend
4. Other environment details: Two instances of opencti, both deployed with docker

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Setup data sharing between two platforms (public live stream on the source, and "perfect synchronization" on the destination)
2. Create a report on the source, create a new domain name and add it to the report
3. Wait for the two instances to be in sync
4. Rename the observable (the one linked to the report)
5. At first, nothing happends to the destination
6. Modify another field of the observable (e.g. the description)
7. A new observable is created on the destination, and the report is still linked to the old one. Instances are not in perfect sync anymore.

Screenshots below

Expected Output

I expect the two instances to be in perfect sync after the reproducible steps.

Actual Output

In the following screenshots, left is the source and right is the destination.

Creation of the report with the observable:

Renaming of the observable, nothing happens on the destination:

Modification of the description of the observable. This creates a new observable on the destination, as shown by the history.

And the old one is still here:

The report is still linked to the first observable:

Additional information

Screenshots (optional)

[nino-filigran]

Hi @axelfahy first, sorry for the time it took to acknowledge this ticket. Do you still have the issue since we resolved the linked issue?

[axelfahy]

Yes, this error still occurs even with the resolution of the linked issue.

[nino-filigran]

I just tested it on my side, I could not access the report anymore. So there's definitevly something going wrong here. For any devs that would have a look into it, I have downloaded a support package if needed.