[CISA] Recreation of software observables, duplicates

[dominictory]

Description

We have the CISA KEV connector. We also have an alert to alert on any new CISA KEVs. We have seen an issue where the connector regularly 'recreates' software observables leading to duplicates, and a 'deleted' entity in the filter. The specific example we have is the Windows software observable that this connector specifically creates. As the observable is recreated, the alert no longer works as we need to add that software observable to the alert filter again.

Environment

6.4.0

Reproducible Steps

Connect CISA KEV connector
Create alert for new CISA KEV entries
When connector runs, observe recreation of software observables
Also observe that in the alert filter for specific software observables in source entity, that there is a 'deleted' entity.

Expected Output

Connector creates relationships with existing software observables to vulnerabilities

Actual Output

Connector creates relationships with existing software observables to vulnerabilities but with new software observable entity

[dominictory]

Still seeing this on 6.4.6