[Activity Logging] "merge" value missing from "Event scope" filter options

[Lhorus6]

Description

In the Activity logging view, merge events are recorded and displayed with the merge event scope. However, when using the "Event scope" filter to search for merge events, the value merge is not available in the filter dropdown. This prevents users from filtering activity logs to isolate merge operations.

Environment

OCTI 6.9.21

Reproducible Steps

1. Navigate to Settings > Activity > Activity logging.
2. Observe that some logged events display merge as their event scope.

3. Open the Event scope filter dropdown.
4. Search for the value merge in the available options.

Expected Output

The value merge should be available in the "Event scope" filter dropdown, allowing users to filter activity logs by merge operations.

Actual Output

The value merge is not present in the "Event scope" filter dropdown. Users cannot filter activity logs to isolate merge events.

[SamuelHassine]

Copilot Fix Instructions

Problem: The merge value is missing from the "Event scope" filter dropdown in the Activity logging view, even though merge events are recorded and displayed with this scope.

Root cause: The event scope vocabulary/enum definition does not include merge as an allowed value. The filter dropdown is populated from this vocabulary, so merge never appears as an option.

Fix approach:

1. Locate the event scope vocabulary definition — likely in opencti-graphql/src/schema/ or a vocabulary/enum file that defines allowed values for event types (look for event_scope, event_type or similar enums containing values like create, update, delete, read).
2. Add merge to the list of allowed event scope values.
3. Ensure the filter component in the frontend picks up this new value (it should automatically if it reads from the vocabulary).

Expected change: Single file — vocabulary/enum definition. The value merge should be added alongside existing values like create, update, delete, read, login, logout.

@copilot