Skip to content

fix(google-dtm): guard optional fields when building the alert content (#7360) #7361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Romain GUIGNARD (romain-filigran) wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix(google-dtm): guard optional fields when building the alert content (#7360) #7361

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b101eb4
fix(google-dtm): guard optional fields when building the alert conten…
romain-filigran Aug 22, 2026
edcb902
fixes GH copilot review
romain-filigran Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion external-import/google-dtm/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
version: '3'
services:
connector-google-dtm:
image: opencti/connector-google-dtm:6.9.10
image: opencti/connector-google-dtm:latest
environment:
# OpenCTI connection parameters
- OPENCTI_URL=http://localhost
Expand All @@ -9,12 +9,12 @@
# Connector's common parameters
- CONNECTOR_ID=ChangeMe
- "CONNECTOR_NAME=Google DTM"
- CONNECTOR_SCOPE=google-dtm

Check warning on line 12 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:12: CONNECTOR_SCOPE=google-dtm has a default — should be commented out
- CONNECTOR_LOG_LEVEL=error

Check warning on line 13 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:13: CONNECTOR_LOG_LEVEL=error has a default — should be commented out
- CONNECTOR_DURATION_PERIOD=PT1H

Check warning on line 14 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:14: CONNECTOR_DURATION_PERIOD=PT1H has a default — should be commented out
# Connector's custom execution parameters
- GOOGLE_DTM_API_KEY=ChangeMe
- GOOGLE_DTM_TLP=amber+strict

Check warning on line 17 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:17: GOOGLE_DTM_TLP=amber+strict has a default — should be commented out
- GOOGLE_DTM_IMPORT_START_DATE=P10D

Check warning on line 18 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:18: GOOGLE_DTM_IMPORT_START_DATE=P10D has a default — should be commented out
- GOOGLE_DTM_ALERT_SEVERITY=

Check warning on line 19 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:19: GOOGLE_DTM_ALERT_SEVERITY= has a default — should be commented out
- GOOGLE_DTM_ALERT_TYPE=

Check warning on line 20 in external-import/google-dtm/docker-compose.yml

View workflow job for this annotation

GitHub Actions / Lint external-import/google-dtm 

VC104: docker-compose.yml:20: GOOGLE_DTM_ALERT_TYPE= has a default — should be commented out
Expand Down
132 changes: 68 additions & 64 deletions external-import/google-dtm/src/google_dtm_connector/converter_to_stix.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,16 +64,16 @@ def create_channel(self, dtm_channel: dict) -> CustomObjectChannel:
:param dtm_channel:
:return:
"""
channel_type = dtm_channel.get("messenger", {}).get("name")
channel_name = dtm_channel.get("name")
channel_description = dtm_channel.get("channel_info").get("description")
channel_type = dtm_channel.get("messenger", {}).get("name") or ""
channel_name = dtm_channel.get("name") or ""
channel_description = dtm_channel.get("channel_info", {}).get("description")
channel_url = dtm_channel.get("channel_url")

formatted_channel_name = "[" + channel_type + "] - " + channel_name
formatted_channel_name = f"[{channel_type}] - {channel_name}"
external_refs = []
if channel_url:
external_ref = stix2.ExternalReference(
source_name=channel_type + " - " + channel_name, url=channel_url
source_name=f"{channel_type} - {channel_name}", url=channel_url
)
external_refs.append(external_ref)
channel = CustomObjectChannel(
Expand All @@ -93,11 +93,11 @@ def generate_incident_description(dtm_alert: dict) -> str:
:return:
"""
markdown_description = f"""
**Alert Id**: {dtm_alert.get("id")}\n
**Alert Id**: {dtm_alert.get("id", "")}\n

**Alert Summary**: {dtm_alert.get("alert_summary")}\n
**Alert Summary**: {dtm_alert.get("alert_summary", "")}\n

**Summary from Gemini**: {dtm_alert.get("ai_doc_summary")}
**Summary from Gemini**: {dtm_alert.get("ai_doc_summary", "")}
"""
return markdown_description

Expand All @@ -109,11 +109,11 @@ def get_common_content_metadata_part(dtm_alert: dict) -> str:
"""
markdown_content = f"""
### Metadata
- **Alert Id**: {dtm_alert.get("id")}
- **Monitor Id**: {dtm_alert.get("monitor_id")}
- **Created**: {dtm_alert.get("created_at")}
- **Type**: {dtm_alert.get("alert_type")}
- **Severity**: {dtm_alert.get("severity")}
- **Alert Id**: {dtm_alert.get("id", "")}
- **Monitor Id**: {dtm_alert.get("monitor_id", "")}
- **Created**: {dtm_alert.get("created_at", "")}
- **Type**: {dtm_alert.get("alert_type", "")}
- **Severity**: {dtm_alert.get("severity", "")}

### Summary from Gemini
{dtm_alert.get("ai_doc_summary", "N/A")}
Expand All @@ -128,22 +128,23 @@ def convert_document_analysis_alert_to_markdown_content(
:return:
"""
metadata_part = self.get_common_content_metadata_part(dtm_alert)
dtm_alert_doc = dtm_alert.get("doc", {})
markdown_content = f"""
{metadata_part}
### Source Information
- **Author**: {dtm_alert.get("doc").get("source_url")}
- **Collected**: {dtm_alert.get("doc").get("ingested")}
- **Published**: {dtm_alert.get("doc").get("timestamp")}
- **Source File**: {dtm_alert.get("doc").get("filename")}
- **MD5**: {dtm_alert.get("doc").get("file_hashes").get("md5")}
- **SHA1**: {dtm_alert.get("doc").get("file_hashes").get("sha1")}
- **SHA256**: {dtm_alert.get("doc").get("file_hashes").get("sha256")}
- **Source**: {dtm_alert.get("doc").get("source")}
- **Source URL**: {dtm_alert.get("doc").get("source_url")}
- **Author**: {dtm_alert_doc.get("source_url", "")}
- **Collected**: {dtm_alert_doc.get("ingested", "")}
- **Published**: {dtm_alert_doc.get("timestamp", "")}
- **Source File**: {dtm_alert_doc.get("filename", "")}
- **MD5**: {dtm_alert_doc.get("file_hashes", {}).get("md5", "")}
- **SHA1**: {dtm_alert_doc.get("file_hashes", {}).get("sha1", "")}
- **SHA256**: {dtm_alert_doc.get("file_hashes", {}).get("sha256", "")}
- **Source**: {dtm_alert_doc.get("source", "")}
- **Source URL**: {dtm_alert_doc.get("source_url", "")}

### Content
```
{dtm_alert.get("doc").get("raw_text")}
{dtm_alert_doc.get("raw_text", "")}
```
"""
return markdown_content
Expand All @@ -154,18 +155,19 @@ def convert_paste_alert_to_markdown_content(self, dtm_alert: dict) -> str:
:return:
"""
metadata_part = self.get_common_content_metadata_part(dtm_alert)
dtm_alert_doc = dtm_alert.get("doc", {})
markdown_content = f"""
{metadata_part}
### Source Information
- **Created**: {dtm_alert.get("doc").get("timestamp")}
- **Paste Id**: {dtm_alert.get("doc").get("paste_id")}
- **URL**: {dtm_alert.get("doc").get("source_location", {}).get("url", "")}
- **Author**: {dtm_alert.get("doc").get("author", {}).get("identity", {}).get("name", "")}
- **Title**: {dtm_alert.get("doc").get("title", "")}
- **Created**: {dtm_alert_doc.get("timestamp", "")}
- **Paste Id**: {dtm_alert_doc.get("paste_id", "")}
- **URL**: {dtm_alert_doc.get("source_location", {}).get("url", "")}
- **Author**: {dtm_alert_doc.get("author", {}).get("identity", {}).get("name", "")}
- **Title**: {dtm_alert_doc.get("title", "")}

### Content
```
{dtm_alert.get("doc").get("body")}
{dtm_alert_doc.get("body", "")}
```
"""
return markdown_content
Expand All @@ -182,19 +184,19 @@ def convert_account_discovery_alert_to_markdown_content(
markdown_content = f"""
{metadata_part}
### Source Information
- **Source URL**: {dtm_alert_doc.get("source_url")}
- **Collected**: {dtm_alert_doc.get("ingested")}
- **Published**: {dtm_alert_doc.get("timestamp")}
- **Source File**: {dtm_alert_doc.get("source_file").get("filename")}
- **MD5**: {dtm_alert_doc.get("source_file").get("hashes").get("md5")}
- **SHA1**: {dtm_alert_doc.get("source_file").get("hashes").get("sha1")}
- **SHA256**: {dtm_alert_doc.get("source_file").get("hashes").get("sha256")}
- **Source URL**: {dtm_alert_doc.get("source_url", "")}
- **Collected**: {dtm_alert_doc.get("ingested", "")}
- **Published**: {dtm_alert_doc.get("timestamp", "")}
- **Source File**: {dtm_alert_doc.get("source_file", {}).get("filename", "")}
- **MD5**: {dtm_alert_doc.get("source_file", {}).get("hashes", {}).get("md5", "")}
- **SHA1**: {dtm_alert_doc.get("source_file", {}).get("hashes", {}).get("sha1", "")}
- **SHA256**: {dtm_alert_doc.get("source_file", {}).get("hashes", {}).get("sha256", "")}
### Content
- **Service URL**: {dtm_alert_doc.get("service_account").get("service").get("inet_location").get("domain")}
- **Service Domain**: {dtm_alert_doc.get("service_account").get("service").get("inet_location").get("url")}
- **Email Domain**: {dtm_alert_doc.get("service_account").get("email_domain")}
- **Login**: {dtm_alert_doc.get("service_account").get("login")}
- **Password**: {dtm_alert_doc.get("service_account").get("password").get("plain_text")}
- **Service URL**: {dtm_alert_doc.get("service_account", {}).get("service", {}).get("inet_location", {}).get("domain", "")}
- **Service Domain**: {dtm_alert_doc.get("service_account", {}).get("service", {}).get("inet_location", {}).get("url", "")}
- **Email Domain**: {dtm_alert_doc.get("service_account", {}).get("email_domain", "")}
- **Login**: {dtm_alert_doc.get("service_account", {}).get("login", "")}
- **Password**: {dtm_alert_doc.get("service_account", {}).get("password", {}).get("plain_text", "")}
"""
return markdown_content

Expand All @@ -208,17 +210,17 @@ def convert_message_type_alert_to_markdown_content(self, dtm_alert: dict) -> str
markdown_content = f"""
{metadata_part}
### Source Information
- **Created**: {dtm_alert_doc.get("ingested")}
- **Channel**: {dtm_alert_doc.get("channel").get("name")}
- **Channel URL**: {dtm_alert_doc.get("channel").get("channel_url")}
- **Channel Description**: {dtm_alert_doc.get("channel").get("channel_info").get("description")}
- **Messenger**: {dtm_alert_doc.get("channel").get("messenger").get("name")}
- **Author**: {dtm_alert_doc.get("sender").get("identity").get("name")}
- **Message Id**: {dtm_alert_doc.get("message_id")}
- **Created**: {dtm_alert_doc.get("ingested", "")}
- **Channel**: {dtm_alert_doc.get("channel", {}).get("name", "")}
- **Channel URL**: {dtm_alert_doc.get("channel", {}).get("channel_url", "")}
- **Channel Description**: {dtm_alert_doc.get("channel", {}).get("channel_info", {}).get("description", "")}
- **Messenger**: {dtm_alert_doc.get("channel", {}).get("messenger", {}).get("name", "")}
- **Author**: {dtm_alert_doc.get("sender", {}).get("identity", {}).get("name", "")}
- **Message Id**: {dtm_alert_doc.get("message_id", "")}

### Content
```
{dtm_alert_doc.get("body")}
{dtm_alert_doc.get("body", "")}
```
"""
return markdown_content
Expand All @@ -233,13 +235,13 @@ def convert_web_content_alert_to_markdown_content(self, dtm_alert: dict) -> str:
markdown_content = f"""
{metadata_part}
### Source Information
- **Created**: {dtm_alert_doc.get("timestamp")}
- **Title**: {dtm_alert_doc.get("title")}
- **Created**: {dtm_alert_doc.get("timestamp", "")}
- **Title**: {dtm_alert_doc.get("title", "")}
- **URL**: {dtm_alert_doc.get("inet_location", {}).get("url", "")}

### Content
```
{dtm_alert_doc.get("text") if "text" in dtm_alert_doc else dtm_alert_doc.get("raw_text")}
{dtm_alert_doc.get("text", "") if "text" in dtm_alert_doc else dtm_alert_doc.get("raw_text", "")}
```
"""
return markdown_content
Expand All @@ -256,9 +258,9 @@ def convert_domain_discovery_alert_to_markdown_content(
markdown_content = f"""
{metadata_part}
### Source Information
- **Created**: {dtm_alert_doc.get("timestamp")}
- **Domain**: {dtm_alert_doc.get("domain")}
- **Source**: {dtm_alert_doc.get("source")}
- **Created**: {dtm_alert_doc.get("timestamp", "")}
- **Domain**: {dtm_alert_doc.get("domain", "")}
- **Source**: {dtm_alert_doc.get("source", "")}
"""
return markdown_content

Expand All @@ -272,15 +274,15 @@ def convert_shop_list_alert_to_markdown_content(self, dtm_alert: dict) -> str:
markdown_content = f"""
{metadata_part}
### Source Information
- **Created**: {dtm_alert_doc.get("ingested")}
- **URL**: {dtm_alert_doc.get("listing_url", {}).get("url")}
- **Shop Name**: {dtm_alert_doc.get("shop", {}).get("name")}
- **Created**: {dtm_alert_doc.get("ingested", "")}
- **URL**: {dtm_alert_doc.get("listing_url", {}).get("url", "")}
- **Shop Name**: {dtm_alert_doc.get("shop", {}).get("name", "")}
- **Price**: {str(dtm_alert_doc.get("price", "")) + dtm_alert_doc.get("currency", "")}
- **Quantity**: {dtm_alert_doc.get("item_qty", "")}
- **Seller**: {dtm_alert_doc.get("seller", {}).get("identity", {}).get("name")}
- **Seller**: {dtm_alert_doc.get("seller", {}).get("identity", {}).get("name", "")}
- **Listing ID**: {dtm_alert_doc.get("listing_id", "")}
- **Listing URL**: {dtm_alert_doc.get("listing_url", {}).get("url", "")}
- **Item Type**: {dtm_alert_doc.get("item_type")}
- **Item Type**: {dtm_alert_doc.get("item_type", "")}
"""
return markdown_content

Expand All @@ -294,7 +296,7 @@ def convert_alert_to_markdown_content(self, dtm_alert: dict) -> str:
{metadata_part}
### Post
```
{dtm_alert.get("doc").get("raw_text")}
{dtm_alert.get("doc", {}).get("raw_text", "")}
```
"""
return markdown_content
Expand All @@ -321,7 +323,7 @@ def create_incident(self, dtm_alert: dict) -> list:
incident_type = dtm_alert.get("alert_type")

# generate a content based on alert useful information
doc_type = dtm_alert.get("doc").get("__type")
doc_type = dtm_alert.get("doc", {}).get("__type")
files = []
try:
if doc_type == "message":
Expand Down Expand Up @@ -397,8 +399,10 @@ def create_incident(self, dtm_alert: dict) -> list:
)
stix_objects.append(stix_incident)

if "channel" in dtm_alert.get("doc"):
stix_channel = self.create_channel(dtm_alert.get("doc").get("channel"))
if "channel" in dtm_alert.get("doc", {}):
stix_channel = self.create_channel(
dtm_alert.get("doc", {}).get("channel", {})
)
stix_objects.append(stix_channel)

# create relation between incident and channel
Expand Down
Loading
Loading