Side deletions of ref relationships can lead to updated_at upgrade

[richard-julien]

Description

Steps

• 1. Create indicator
• 2. Put indicator in a report -> updated_at of indicator do not move => OK
• 3. Remove indicator of the report -> updated_at of indicator change => KO.

Expected

Updated_at must remains identical

Hints

Side remove function doest not check the direction.
See elRemoveRelationConnection function

          if (isStixRefRelationship(relationType)) {
            source += 'ctx._source[\'updated_at\'] = params.updated_at;';
          }