Skip to content

Fix pre-commit linting failures in TI provider#870

Merged
ianhelle merged 8 commits intomainfrom
copilot/fix-ti-lookup-error
Jan 21, 2026
Merged

Fix pre-commit linting failures in TI provider#870
ianhelle merged 8 commits intomainfrom
copilot/fix-ti-lookup-error

Conversation

Copy link
Contributor

Copilot AI commented Jan 16, 2026

Pre-commit hooks were failing on the TI provider refactoring due to complexity warnings and missing dependencies.

Changes

Suppressed complexity warnings in parse_results

  • Method legitimately requires high branch/statement count to handle dual schema support (old ThreatIntelligenceIndicator + new ThreatIntelIndicators STIX format)
  • Added # noqa: PLR0912, PLR0915 # pylint: disable=too-many-branches

Fixed check_reqs_all pre-commit hook

  • Added setuptools>=42 to .pre-commit-config.yaml additional_dependencies
  • Resolves ModuleNotFoundError: No module named 'setuptools.config'

Suppressed bandit B105 false positives

  • Added # nosec comments in three driver files to suppress false positive warnings for hardcoded passwords
  • msticpy/data/drivers/openobserve_driver.py - documentation string for password parameter
  • msticpy/data/drivers/splunk_driver.py - documentation string for password parameter
  • msticpy/data/drivers/security_graph_driver.py - None value for client_secret initialization
  • These are confirmed false positives (documentation strings, not actual credentials)
Original prompt

This section details on the original issue you should resolve

<issue_title>[Bug]: TI Lookups using Microsoft Sentinel provider failing due to new table and schema in Sentinel</issue_title>
<issue_description>Describe the bug
The TI provider (and built in queries) for Sentinel Threat Intel use the old ThreatIntelligenceIndicator table instead of the new ThreatIntelIndicators. As the old table is no longer being populated with TI data, it will return 0 results even if there is matching TI stored in Sentinel

To Reproduce
Steps to reproduce the behavior:

  1. Create a piece of TI in Sentinel
  2. Use IpAddress.tilookup_ip() to try and find it
  3. Get 0 results

Expected behavior
Matching TI from Sentinel should be returned

Additional context
https://learn.microsoft.com/en-us/azure/sentinel/work-with-threat-indicators?tabs=defender-portal#find-and-view-threat-intelligence-with-queries
</issue_description>

<agent_instructions>Check the queries used for TI lookups and adjust them to the new schema</agent_instructions>

Comments on the Issue (you are @copilot in this section)


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 3 commits January 16, 2026 17:47
Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
…patibility

Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix TI lookups using Microsoft Sentinel provider Migrate TI provider to new ThreatIntelIndicators table schema Jan 16, 2026
Copilot AI requested a review from ianhelle January 16, 2026 17:56
@ianhelle ianhelle marked this pull request as ready for review January 21, 2026 17:25
@ianhelle ianhelle self-requested a review January 21, 2026 17:26
Copilot AI and others added 3 commits January 21, 2026 17:47
Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
…s dependency

Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
Copilot AI changed the title Migrate TI provider to new ThreatIntelIndicators table schema Fix pre-commit linting failures in TI provider Jan 21, 2026
Copilot AI requested a review from ianhelle January 21, 2026 17:56
@ianhelle
Copy link
Contributor

@copilot - please suppress the bandit errors (using # nosec) in the three files indicated in the linting failures: msticpy/data/drivers/openobserve_driver.py, splunk_driver.py and security_graph_driver

Co-authored-by: ianhelle <13070017+ianhelle@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Jan 21, 2026

@copilot - please suppress the bandit errors (using # nosec) in the three files indicated in the linting failures: msticpy/data/drivers/openobserve_driver.py, splunk_driver.py and security_graph_drive...

Suppressed bandit B105 false positives with # nosec comments in all three files (4bca99b). The warnings were for documentation strings describing password parameters, not actual hardcoded passwords.

Copilot AI requested a review from ianhelle January 21, 2026 18:15
@ianhelle ianhelle disabled auto-merge January 21, 2026 18:25
@ianhelle ianhelle merged commit 2607374 into main Jan 21, 2026
11 checks passed
@ianhelle ianhelle deleted the copilot/fix-ti-lookup-error branch January 21, 2026 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: TI Lookups using Microsoft Sentinel provider failing due to new table and schema in Sentinel

2 participants