From 8d429e5daef5ff0cf4704b631f923cbbd669e1b4 Mon Sep 17 00:00:00 2001 From: Luciano Righetti Date: Thu, 29 Oct 2026 13:18:50 +0100 Subject: [PATCH] Explore: exact totals for events, attributes and correlations OpenSearch counts hits up to 10,000 unless asked for the exact total, so Explore's events, attributes and correlations tabs stopped at 10000 while indicators (which already asked) showed the real count. Co-Authored-By: Claude Opus 5.5 --- api/app/repositories/attributes.py | 2 ++ api/app/repositories/correlations.py | 2 ++ api/app/repositories/events.py | 2 ++ 3 files changed, 6 insertions(+) diff --git a/api/app/repositories/attributes.py b/api/app/repositories/attributes.py index ab281fea..8ff77f79 100644 --- a/api/app/repositories/attributes.py +++ b/api/app/repositories/attributes.py @@ -575,6 +575,8 @@ def search_attributes( "from": from_value, "size": size, "sort": [{sort_by: {"order": sort_order}}], + # The exact total, not "10000+": Explore shows it. + "track_total_hits": True, } response = OpenSearchClient.search(index="misp-attributes", body=search_body) diff --git a/api/app/repositories/correlations.py b/api/app/repositories/correlations.py index cde7e1fa..a52209ed 100644 --- a/api/app/repositories/correlations.py +++ b/api/app/repositories/correlations.py @@ -841,6 +841,8 @@ def search_correlations( "from": from_value, "size": size, "sort": [{sort_by: {"order": sort_order}}], + # The exact total, not "10000+": Explore shows it. + "track_total_hits": True, } try: diff --git a/api/app/repositories/events.py b/api/app/repositories/events.py index c95badc1..683763b9 100644 --- a/api/app/repositories/events.py +++ b/api/app/repositories/events.py @@ -197,6 +197,8 @@ def search_events( "from": from_value, "size": size, "sort": [{sort_by: {"order": sort_order}}], + # The exact total, not "10000+": Explore shows it. + "track_total_hits": True, } response = OpenSearchClient.search(index=index, body=search_body)