Numbers not matching with various widgets & investigation graphs

[nino-filigran]

Description

We've been reached out to because some users have the following issue: with the same filters but different visualisation, widgets are not displaying the same information.

I've reproduced with the following dashboard: https://testing.octi.staging.filigran.io/dashboard/workspaces/dashboards/58ea5953-048c-4fcf-a2d8-83ae95f99caa

54 relations displayed with the number widget
67 relations displayed with the distribution list widget
50 with the list widget (while I put the limit to 100 of items)

Given I was not able to find out the amount of relations from a given intrusion set due to missing knowledge view, I've also created an investigation with a single intrusion set (Akira) and expanded the targets (indicated intially as 41, like the distribution list). But When I click on expand, only 32 gets displayed and 9 refuses to be displayed, even though I'm clicking on it https://testing.octi.staging.filigran.io/dashboard/workspaces/investigations/bf9c0bd7-ce73-4229-a68c-12410ced67e5?zoom=%7B%22k%22%3A3.2257207633710636%2C%22x%22%3A0%2C%22y%22%3A0%7D&mode3D=false&selectRectangleModeFree=false&selectModeFree=false&selectModeFreeReady=true&modeFixed=true&modeTree=&displayTimeRange=false&selectedTimeRangeInterval=2023-12-25T23%3A00%3A00.000Z%2C2024-12-19T23%3A00%3A00.000Z&stixCoreObjectsTypes=&markedBy=&createdBy=&displayProgress=false&width=null&height=null&zoomed=false&keyword=&prevClick=null&openCreatedRelation=false&isRollBackPreExpandStateDialogOpen=false

Environment

Testing

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Create a dashboard
2. create a number widget with the following query:
3. duplicate it with a distribtuion list vizualisation
4. duplicate it with a list view
   

Expected Output

All numbers match

Actual Output

54 relations displayed with the number widget
67 relations displayed with the distribution list widget
50 with the list widget (while I put the limit to 100 of items)

Additional information

In investigation, the result for each intrusion set seem to match the numbers in the distribution list widget when I click on expand (the number between brackets) but they are not all expanded.

Screenshots (optional)