From e32b9ecc383e39c577e1cefb195875b38ac128ae Mon Sep 17 00:00:00 2001
From: Jeremy Cloarec <159018898+JeremyCloarec@users.noreply.github.com>
Date: Wed, 15 Jan 2025 11:56:42 +0100
Subject: [PATCH] [backend] fix internal_id being removed during observable
 fullsync (#8986)

---
 .../opencti-graphql/src/domain/stixCyberObservable.js         | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/opencti-platform/opencti-graphql/src/domain/stixCyberObservable.js b/opencti-platform/opencti-graphql/src/domain/stixCyberObservable.js
index 4d3e4a432b06..2b5f2fb8157b 100644
--- a/opencti-platform/opencti-graphql/src/domain/stixCyberObservable.js
+++ b/opencti-platform/opencti-graphql/src/domain/stixCyberObservable.js
@@ -204,7 +204,6 @@ export const addStixCyberObservable = async (context, user, input) => {
     return artifactImport(context, user, { ...input, ...input[graphQLType] });
   }
   const observableInput = {
-    internal_id,
     stix_id,
     x_opencti_score,
     x_opencti_description,
@@ -216,6 +215,9 @@ export const addStixCyberObservable = async (context, user, input) => {
     update,
     ...input[graphQLType]
   };
+  if (internal_id) {
+    observableInput.internal_id = internal_id;
+  }
   if (isNotEmptyField(payload_bin) && isNotEmptyField(url)) {
     throw FunctionalError('Cannot create observable with both payload_bin and url filled.');
   }