[Sentinel-intel] Bad management of updates and non-deletion

[Lhorus6]

Description

The Sentinel-intel connector allowing to feed Sentinel with IOCs does its role of "creation" but not of "update", nor of "deletion". Here are the problems observed:

• When updating an element on the OpenCTI side, the existing Indicator on the Sentinel side is not modified. Instead, the connector adds a new entry in the Sentinel table (therefore a duplicate but with the up-to-date values)
• When deleting, the Sentinel connector seems to do nothing, i.e. the Indicator in question remains in the Sentinel table.

Environment

OCTI 6.4.7

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Deploy a Sentinel-intel connector
2. Play with the creation, update and deletion of Indicator and see the behavior on the Sentinel side.

Expected Output

• When I create an Indicator on OpenCTI -> I create an entry in my Sentinel table.
• When I update an Indicator on OpenCTI -> I update the existing entry in my Sentinel table.
• When I delete an Indicator on OpenCTI -> I delete the existing entry in my Sentinel table.

Actual Output

See in the description

[Lhorus6]

Maybe the same root cause : #3177