Description
The Google Threat Intelligence API exposes structured analyst_comment fields on various collection objects (Threat Actors, Malware, Campaigns, Vulnerabilities, etc.). These are human-written analyst comments (not AI-generated summaries) that provide valuable contextual analysis.
The GTI connector does not currently map these comments into OpenCTI. They should be created as Note objects linked to the parent entity, similar to how vulnerability executive_summary and analysis fields were recently mapped in PR #6215.
Expected Behavior
- When a GTI object contains an
analyst_comment field, the connector should create a Note STIX object with the comment content
- The Note should be linked to the parent entity via
object_refs
- The Note should include appropriate metadata (author, creation date) from the API response
Current Behavior
analyst_comment fields are silently dropped during ingestion- No Note objects are created for analyst commentary
API Reference
The analyst_comment field is available on GTI collection endpoints for:
- Threat Actors (
/threat_actors/{id})
- Malware (
/files/{id})
- Campaigns (
/campaigns/{id})
- Vulnerabilities (
/vulnerabilities/{id})
Related
Description
The Google Threat Intelligence API exposes structured
analyst_commentfields on various collection objects (Threat Actors, Malware, Campaigns, Vulnerabilities, etc.). These are human-written analyst comments (not AI-generated summaries) that provide valuable contextual analysis.The GTI connector does not currently map these comments into OpenCTI. They should be created as
Noteobjects linked to the parent entity, similar to how vulnerabilityexecutive_summaryandanalysisfields were recently mapped in PR #6215.Expected Behavior
analyst_commentfield, the connector should create aNoteSTIX object with the comment contentobject_refsCurrent Behavior
analyst_commentfields are silently dropped during ingestionAPI Reference
The
analyst_commentfield is available on GTI collection endpoints for:/threat_actors/{id})/files/{id})/campaigns/{id})/vulnerabilities/{id})Related
executive_summaryandanalysisfields