feat(pan-cortex-xdr-intel): implement shared integration foundation and global error handling (#7185) - #7331
Open
Pauline Eustachy (Powlinett) wants to merge 5 commits into
Conversation
Introduce EventIndicator/IndicatorObservable pydantic models to decouple downstream upsert/delete handlers from OpenCTI's raw STIX stream payload shape. Field casting/validation is delegated to pydantic to fail fast. The observables field_validator flattens a StixFile's filename and each hash algorithm value into separate observables, since Cortex XDR treats them as distinct IOC types (FILENAME vs HASH).
Implement _process_message: filter unsupported events/entity types (log + skip), decode the stream payload, and parse it into an EventIndicator via _parse_indicator, restricting extracted observables to the types Cortex XDR can currently consume. JSON decode errors, Indicator validation errors, and any other unexpected exception are logged with context and re-raised, letting pycti kill the connector process instead of silently missing or corrupting further stream events. Replace the filigran_sseclient.Event typing dependency with a local StreamMessage Protocol declaring only the attributes actually consumed.
Cover EventIndicator's observables field_validator (valid/invalid construction, StixFile hash/filename flattening, missing value/hashes, None defaulting).
…ling Cover Connector._process_message's event/entity guardrails, indicator parsing, and fatal error handling (JSON decode error, validation error, and a documented xfail for the not-yet-implemented upsert/delete error path).
Add an anonymized example SSE stream message (Indicator create event with a StixFile observable) illustrating the payload shape consumed by Connector._process_message, for local/manual reference.
Filigran Automation (Filigran-Automation)
added
the
filigran team
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
EventIndicator/IndicatorObservablepydantic models decoupling downstream upsert/delete handlers from OpenCTI's raw STIX stream payload shape (field casting/validation delegated to pydantic to fail fast).Connector._process_message: entity/event guardrails (non-Indicator and unsupported-event stream messages are logged as a warning and skipped), indicator parsing via_parse_indicator, and observable extraction restricted to Cortex XDR's currently-supported types.Indicatorvalidation errors, and any other unexpected exception are logged with context and re-raised, lettingpyctikill the connector process rather than risk silently missing/corrupting further stream events.filigran_sseclient.Eventtyping dependency with a localStreamMessageProtocoldeclaring only the attributes actually consumed.data_samples/for local/manual reference.Related issues
Checklist
Further comments
This PR stacks on top of #7309 (#7184 - Cortex XDR API client). Upsert/delete lifecycle logic (#7186/#7187) is intentionally out of scope here; the corresponding
try/exceptblock in_process_messagecurrently wrapspassplaceholders, documented by astrict=Truexfailtest that must be removed once real client calls land there.While investigating the observable → Cortex XDR IOC type mapping (comments left on #7186/#7187), found that the XDR IOC API's
typeenum has no dedicatedURL/EMAIL_ADDRESSvalue;url/email-addrwere dropped from_SUPPORTED_OBSERVABLE_TYPESfor this reason, to be revisited when #7186/#7187 land.