fix(recordedfuture): report creator is no longer added to Report object_refs (#7003)

[Romain GUIGNARD (romain-filigran)]

Proposed changes

• The author identity is metadata referenced through 'created_by_ref', not report content. 'to_stix_objects()' now returns the entity only, and the author is added once per bundle by '_bundle_objects()'. This also fixes the dangling 'created_by_ref' in indicator and vulnerability risk list bundles, where the author identity was only present by accident.

Related issues

• closes fix(recorded-future): Report creator is incorrectly added to Report object_refs #7003

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[github-actions]

⚠️ Unused dependencies detected

The following packages appear to be unused:

• antlr4-python3-runtime in external-import/recorded-future/src/requirements.txt
• chardet in external-import/recorded-future/src/requirements.txt
• datefinder in external-import/recorded-future/src/requirements.txt
• idna in external-import/recorded-future/src/requirements.txt
• pika in external-import/recorded-future/src/requirements.txt
• python-dateutil in external-import/recorded-future/src/requirements.txt
• PyYAML in external-import/recorded-future/src/requirements.txt
• regex in external-import/recorded-future/src/requirements.txt
• rfapi in external-import/recorded-future/src/requirements.txt
• simplejson in external-import/recorded-future/src/requirements.txt
• six in external-import/recorded-future/src/requirements.txt
• sseclient in external-import/recorded-future/src/requirements.txt
• stix2-patterns in external-import/recorded-future/src/requirements.txt
• urllib3 in external-import/recorded-future/src/requirements.txt

How to fix: (1) if the package is used but under a different import name (e.g. PyYAML → yaml), add a mapping line to .github/deptry-package-map.txt. (2) if truly unused, remove it from the connector's requirements.txt.

[github-actions]

🔴 Connector Linter errors detected

• VC309: Relative import: from ._version import version (external-import/recorded-future/src/rflib/init.py:13)
• VC309: Relative import: from .analyst_note import AnalystNote (external-import/recorded-future/src/rflib/init.py:14)
• VC309: Relative import: from .constants import RISK_LIST_TYPE_MAPPER (external-import/recorded-future/src/rflib/init.py:15)
• VC309: Relative import: from .pyrf import RecordedFutureApiClient (external-import/recorded-future/src/rflib/init.py:16)
• VC309: Relative import: from .rf_alerts import RecordedFutureAlertConnector (external-import/recorded-future/src/rflib/init.py:17)
• VC309: Relative import: from .rf_client import RFClient (external-import/recorded-future/src/rflib/init.py:18)
• VC309: Relative import: from .rf_playbook_alerts import RecordedFuturePlaybookAlertConnector (external-import/recorded-future/src/rflib/init.py:19)
• VC309: Relative import: from .rf_to_stix2 import TTP, URL, Domain, FileHash, Identity, IPAddress, Malware, StixNote (external-import/recorded-future/src/rflib/init.py:20)
• VC309: Relative import: from .risk_list import RiskList (external-import/recorded-future/src/rflib/init.py:30)
• VC309: Relative import: from .threat_map import ThreatMap (external-import/recorded-future/src/rflib/init.py:31)
• VC309: Relative import: from .constants import THREAT_MAP_TYPE_MAPPER (external-import/recorded-future/src/rflib/threat_map.py:5)
• VC309: Relative import: from .constants import SUPPORTED_PLAYBOOK_ALERT_CATEGORIES, TLP_MAP (external-import/recorded-future/src/rflib/rf_playbook_alerts.py:9)
• VC309: Relative import: from .utils import make_markdown_table (external-import/recorded-future/src/rflib/rf_playbook_alerts.py:10)
• VC309: Relative import: from .constants import SUPPORTED_PLAYBOOK_ALERT_CATEGORIES (external-import/recorded-future/src/rflib/pyrf.py:6)
• VC309: Relative import: from .rf_to_stix2 import URL, Domain, FileHash, IntrusionSet, IPAddress, Malware, Vulnerability (external-import/recorded-future/src/rflib/constants.py:4)
• VC309: Relative import: from .constants import RISK_LIST_TYPE_MAPPER, RISK_RULES_MAPPER (external-import/recorded-future/src/rflib/risk_list.py:7)
• VC309: Relative import: from .rf_to_stix2 import StixNote (external-import/recorded-future/src/rflib/analyst_note.py:4)
• VC309: Relative import: from .constants import TLP_MAP (external-import/recorded-future/src/rflib/rf_alerts.py:15)
• VC309: Relative import: from .pyrf import Alert, RecordedFutureApiClient, RecordedFutureApiError (external-import/recorded-future/src/rflib/rf_alerts.py:16)
• VC309: Relative import: from .utils import is_ip_v4_address, is_ip_v6_address, make_markdown_table (external-import/recorded-future/src/rflib/rf_alerts.py:17)
• VC310: Default external_references=self.external_reference(s) on RFReport() (external-import/recorded-future/src/rflib/rf_to_stix2.py:1578)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/threat_map.py:108)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/rf_playbook_alerts.py:356)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/rf_playbook_alerts.py:487)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/rf_playbook_alerts.py:711)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/rf_playbook_alerts.py:895)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/risk_list.py:247)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/analyst_note.py:154)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/recorded-future/src/rflib/rf_alerts.py:563)
• VC402: Dockerfile uses entrypoint.sh at line 17 (external-import/recorded-future/Dockerfile:17)
• VC501: uses deprecated schedule_unit() (external-import/recorded-future/src/main.py:238)

[Copilot]

Pull request overview

Updates Recorded Future STIX conversion so report authors are retained as bundle metadata rather than report content.

Changes:

• Deduplicates author identities during bundle creation.
• Removes authors from report object_refs.
• Adds regression coverage for author handling.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Summary
external-import/recorded-future/src/rflib/rf_to_stix2.py	Updates STIX conversion and bundling; a trailing comma is required for Black formatting.
external-import/recorded-future/tests/tests_connector/test_rf_to_stix2.py	Adds regression tests for author exclusion and bundle inclusion.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.