Marking of an observable imported into a Grouping via the datatab and importdoc connector will to reflect overall marking of the Grouping

[nhuber0724]

Description

When importing an entity (e.g. observable) using the datatab of a Grouping, the observable's marking will change to reflect the overall marking of the Grouping, unless the observable has the same or more restrictive level marking than the Grouping.

Environment

OpenCTI v6.4.7

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Select a Grouping with an overall marking
2. Go into the datatab of a grouping
3. Import an observable (that has a less restrictive TLP marking than the overall Grouping Marking) that already exists within the platform using TXT.
4. Import the observable using the importdoc connector
5. Review the observable on the observable tab. The observable's marking will change to reflect the overall group marking

Expected Output

The observable marking should maintain its original marking and not take on the overall group marking.

Actual Output

The observable marking changes to reflect the overall group marking if the observable has a less restrictive TLP marking.

Additional information

Screenshots (optional)

[nino-filigran]

@nhuber0724 could you provide me your file please so that I can reproduce?