Skip to content

[Sekoia/Crowdstrike/Mandiant/AlienVault/RecordedFuture/CisaKEV] Modification on connector to use the new pycti connector helper scheduler #2459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Megafredo merged 26 commits into from
Sep 10, 2024
Merged

[Sekoia/Crowdstrike/Mandiant/AlienVault/RecordedFuture/CisaKEV] Modification on connector to use the new pycti connector helper scheduler #2459

Megafredo merged 26 commits into from
Sep 10, 2024

Conversation

@helene-nguyen
Copy link
Member

@helene-nguyen helene-nguyen commented Aug 7, 2024 •
edited
Loading

Why changes ?

As a new scheduler is added into client-python, these modifications on connectors is to use the new pycti connector helper scheduler

Here are the connectors concerned:

  • Cisa KEV
  • Recorded Future
  • Sekoia
  • Mandiant
  • Crowdstrike
  • AlienVault

Cisa KEV

Proposed changes

  • Modification on connector to use the new pycti connector helper scheduler (schedule_iso)
  • Catch exception outside running connector process by adding a traceback.print_exc()
  • Remove update_existing_data as it is deprecated
  • Improve the connector to fill in the "CISA KEV" field (x_opencti_cisa_kev)

Recorded Future

Proposed changes

  • Modification on connector to use the new pycti connector helper scheduler
  • Add new environment variable to enable or not Analyst Notes pulling
  • Refactored code

Mandiant

Proposed changes

  • Modification on connector to use the new pycti connector helper scheduler
  • Remove update_existing_data as it is deprecated

Sekoia

Proposed changes

  • Modification on connector to use the new pycti connector helper scheduler
  • Remove update_existing_data and confidence_level from config.yml.sample as it is deprecated

Crowdstrike

Proposed changes

  • Modification on connector to use the new pycti connector helper scheduler
  • Remove update_existing_data as it is deprecated

AlienVault

Proposed changes

  • Modification on connector to use the new pycti connector helper scheduler
  • Remove update_existing_data and confidence_level from config.yml.sample as it is deprecated

Related issues

Related PR

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

@helene-nguyen helene-nguyen added filigran team use to identify PR from the Filigran team do not merge Do not merge this PR until this tag will be removed labels Aug 7, 2024
@helene-nguyen helene-nguyen requested a review from Megafredo August 7, 2024 08:38
@helene-nguyen helene-nguyen self-assigned this Aug 7, 2024
@helene-nguyen helene-nguyen requested a review from Kedae August 7, 2024 08:41
This was linked to issues Aug 7, 2024
[CISA KEV] Add scheduler to align with the new way to handle interval (opencti/issue/6325) #2395
Closed
[CISA KEV] Improve connector to populate "CISA Exploited" field #2222
Closed
[Recorded Future] Ability to activate/deactivate Reports ingestion in config file #2354
Closed
[Crowdstrike] Add scheduler to align with the new way to handle interval (opencti/issue/6325) #2362
Closed
[Mandiant] Add scheduler to align with the new way to handle interval (opencti/issue/6325) #2365
Closed
[Sekoia] Add scheduler to align with the new way to handle interval (opencti/issue/6325) #2366
Closed
[AlienVault] Add scheduler to align with the new way to handle interval (opencti/issue/6325) #2369
Closed
[Recorded Future] Add scheduler to align with the new way to handle interval (opencti/issue/6325) #2375
Closed
Kedae
Kedae previously requested changes Aug 7, 2024
View reviewed changes
Copy link
Member

@Kedae Kedae left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wait for release

@Kedae Kedae removed the do not merge Do not merge this PR until this tag will be removed label Aug 7, 2024
@helene-nguyen helene-nguyen force-pushed the opencti/issue/6325-all-for-release branch from b8f5218 to ee70cd6 Compare August 19, 2024 16:24
@Kedae Kedae dismissed their stale review August 23, 2024 12:19

Not needed

@helene-nguyen helene-nguyen added the do not merge Do not merge this PR until this tag will be removed label Aug 29, 2024
@helene-nguyen
Copy link
Member Author

helene-nguyen commented Aug 29, 2024

Add label do not merge, waiting for release 6.3

Please check @labo-flg if more details is needed

@helene-nguyen helene-nguyen force-pushed the opencti/issue/6325-all-for-release branch from ee70cd6 to 401806e Compare August 30, 2024 15:58
@SamuelHassine SamuelHassine force-pushed the master branch 3 times, most recently from ec6b6e1 to 60bbbbe Compare September 4, 2024 13:58
@Megafredo Megafredo force-pushed the opencti/issue/6325-all-for-release branch from 401806e to b8e2a85 Compare September 6, 2024 09:53
helene-nguyen and others added 23 commits September 10, 2024 09:54
@helene-nguyen @Megafredo
[connector] remove unused methods
06fdeee
@Megafredo
[Crowdstrike] Update readme, config, docker-compose
e421d01
@helene-nguyen @Megafredo
[connector] Remove deprecated update_existing_data and confidence lev…
a3c1975 
…el env variables
@helene-nguyen @Megafredo
[connector] Add scheduler no breaking changes
e33f7e7
@helene-nguyen @Megafredo
[connector] Add scheduler to mandiant connector (breaking changes)
77d55ca
@Megafredo
[Mandiant] Update Readme, docker-compose and config
fd6254b
@helene-nguyen @Megafredo
[connector] Add scheduler + remove deprecated environment variables
76214c0
@Megafredo
[Sekoia] Fix get config, up readme, remove while trueÃ
e430be8
@helene-nguyen @Megafredo
[connector] Modification on connector to use the new pycti connector …
f594201 
…helper scheduler
@Megafredo
[AlienVault] Update Readme, docker-compose, and update_data
1c79996
@helene-nguyen @Megafredo
[connector] Modification on connector to use the new pycti connector …
47d41f8 
…helper scheduler
@helene-nguyen @Megafredo
[connector] complete env var docker compose
6c10bca
@helene-nguyen @Megafredo
[connector] lint
872d610
@helene-nguyen @Megafredo
[connector] remove all interval usages
ea4a253
@helene-nguyen @Megafredo
[connector] avoid re-instanciate helper
a349f10
@Megafredo
[Connector] Update Readme, docker-compose, config and remove update_e…
7c27a89 
…xisting_data
@Megafredo
[CISA KEV] Modification on connector to use the new pycti connector h…
89fc286 
…elper scheduler
@Megafredo
[CISA KEV] Update linter
da1dbb7
@Megafredo
[CISA KEV] Update linter
720bab2
@helene-nguyen @Megafredo
[connector] correct naming duration period
6e3cea1
@helene-nguyen @Megafredo
[connector] fix lint
5e227d7
@Megafredo
[Sekoia/Crowdstrike/Mandiant/AlienVault/RecordedFuture/CisaKEV] Updat…
2b156aa 
…e scheduler
@Megafredo
[RecordedFuture] Interval that can handle integer and float values in…
a7ccd9b 
… hours
@Megafredo Megafredo force-pushed the opencti/issue/6325-all-for-release branch from b8e2a85 to a7ccd9b Compare September 10, 2024 08:34
@Megafredo Megafredo merged commit 78abfef into master Sep 10, 2024
@Megafredo Megafredo added solved use to identify issue that has been solved (must be linked to the solving PR) and removed do not merge Do not merge this PR until this tag will be removed labels Sep 10, 2024
@Megafredo Megafredo deleted the opencti/issue/6325-all-for-release branch September 10, 2024 09:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Megafredo Megafredo Megafredo approved these changes

@Kedae Kedae Kedae left review comments

@richard-julien richard-julien Awaiting requested review from richard-julien

Assignees

@helene-nguyen helene-nguyen

Labels

filigran team use to identify PR from the Filigran team solved use to identify issue that has been solved (must be linked to the solving PR)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Sekoia] Add scheduler to align with the new way to handle interval (opencti/issue/6325) [Mandiant] Add scheduler to align with the new way to handle interval (opencti/issue/6325) [Crowdstrike] Add scheduler to align with the new way to handle interval (opencti/issue/6325) [Recorded Future] Ability to activate/deactivate Reports ingestion in config file [CISA KEV] Improve connector to populate "CISA Exploited" field
[AlienVault] Add scheduler to align with the new way to handle interval (opencti/issue/6325) [Recorded Future] Add scheduler to align with the new way to handle interval (opencti/issue/6325) [CISA KEV] Add scheduler to align with the new way to handle interval (opencti/issue/6325)

3 participants

@helene-nguyen @Megafredo @Kedae