Broken collected filter for available-domains endpoint

[exploide]

Description:

A request to /api/v2/available-domains?collected=eq:false does not return the not collected domains but an empty list instead. However, a request to /api/v2/available-domains?collected=eq:true returns only collected domains, as expected. It seems the negative filtering is broken. Maybe because the attribute does not exist in this case?

Component(s) Affected:

• UI
• API
• Neo4j
• PostgreSQL
• Data Collector (SharpHound, AzureHound)
• Other (tooling, documentation, etc.)

Steps to Reproduce:

1. Import the sample data from this repository
2. Perform the request to /api/v2/available-domains?collected=eq:true and see that the three collected domains are returned correctly.
3. Perform the request to /api/v2/available-domains?collected=eq:false and see that an empty list is returned instead of the two not collected domains.

Expected Behavior:

I would have expected that the negative filtering works as well as the positive filtering does.

Actual Behavior:

Negative filtering does not work.

Environment Information:

BloodHound: 5.9.0

Collector: what ever you used to generate the sample data

Potential Solution (Optional):

I could imagine this is because the collected property does not exist in the neo4j data for not collected domains. This needs to be worked around.

Contributor Checklist:

• I have searched the issue tracker to ensure this bug hasn't been reported before or is not already being addressed.
• I have provided clear steps to reproduce the issue.
• I have included relevant environment information details.
• I have attached necessary supporting documents.
• I have checked that any JSON files I am attempting to upload to BloodHound are valid.

[elikmiller]

Hey @exploide - I've validated this issue and I think you have the right idea. The collected property is not being set on all Domain or AZTenant nodes which breaks the query.

For now, I believe you can work around this by leveraging the following cypher query:
MATCH (n) WHERE (n:Domain OR n:AZTenant) AND n.collected IS NULL RETURN n

[exploide]

This was fixed in #684, thank you.