User unable to export filtered indicators

[EinatAR]

Description

Issue might be related to this issue: #8405

This is how the bug originally reported, on a user with the capabilities to Generate Knowledge Export, unable to export in txt/plain or csv/txt and receives an error message.

Reproducible Steps

1. Created a user with the capabilities to Generate Knowledge Export:

2. Go to Indicators,

Filter on "In regards of" -> Malware -> Lumma

3. Pick a few from the list and check the boxes

4. Click Open Export Panel

5. Click +

To generate the export in plain/txt:

Expected Output

Generate an export

Actual Output

Receiving an error :

[nino-filigran]

At first, I did not reproduced. But then after syncing with @EinatAR I reproduced. It's important to note that Allowed markings for the repro cases are TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN, TLP:CLEAR and Maximum Shareable marking TLP = no restriction
Import is only on TLP:clear entities (IOCs).

However, it's important to note that:

• if my user has TLP:RED and:
  • max shareable marking = TLP: RED & I create an export of the file without specifying a marking, it works.
  • max shareable marking = TLP:RED & I create an export of the file with a specific TLP markingon the file, it works
  • max shareable marking = no restriction & I create an export of the file without specifying a marking, it works.
  • max shareable marking = no restriction & I create an export of the file with a specific TLP markingon the file, it works
• If my user has all TLP except TLP RED and :
  • max shareable marking = TLP: AMBER & I create an export of the file without specifying a marking, it fails.
  • max shareable marking = TLP:AMBER & I create an export of the file with a specific TLP markingon the file, it fails
  • max shareable marking = no restriction & I create an export of the file without specifying a marking, it fails.
  • max shareable marking = no restriction & I create an export of the file with a specific TLP markingon the file, it fails

[Kedae]

[Kedae]

We should also try to fix : the export button is available even if you do not have the capability

[nino-filigran]

@JeremyCloarec Important to note that it seems to happen only on testing for me

[JeremyCloarec]

The bug comes from the fact that the indicators have an Author that is not accessible by the user, and the connector trying to access the standard_id of the Author. The bug can be reproduced using this query with the user not having access to TLP:RED :
query indicator { indicators { edges{ node{ id entity_type name createdBy { id name standard_id } } } } }

I'm not entirely sure how to fix it for now though

[richard-julien]

As the logic for now of the export do not use the stix generation from the API, i think we need to modify the export connector code to ignore the error when the creator is not accessible, and so export the indicator without his organization