[Flashpoint] Import CCM Alerts as Incidents #4025
Conversation
connector's state is set with the same logic as in other methods for consistency
Powlinett
added
filigran team
filter to fetch only fresh CCM alerts from Flashpoint
add specific last run datetimes for each type of import
+ move mermaid diagrams
| from pydantic import AliasPath, BaseModel, ConfigDict, Field | ||
|
|
||
|
|
||
| class FrozenBaseModel(BaseModel): |
There was a problem hiding this comment.
This works fine but I think there is no need to freeze you model here. Feel free to correct me otherwise !
There was a problem hiding this comment.
I thought it was better to freeze Flashpoint's objects to avoid modifying the data returned by their API, WDYT?
| ): | ||
| compromised_credential_sighting = CompromisedCredentialSighting.model_validate( | ||
| # Typical Compromised Credential Sighting in response to /search endpoint call | ||
| { |
There was a problem hiding this comment.
I think this is a duplication of your data sample
There was a problem hiding this comment.
Not quite sure if I understood correctly your comment, but I pushed a commit where I re-use the data sample in test_converter_to_stix.py. Let me know if it's not the expected fix ^^
There was a problem hiding this comment.
Thank you for this work @Powlinett !
The implemented features are clear, and the refactoring you did makes the code more robust and easier to read/maintain. The additional improvements, including the unit tests, the refactoring of the connector states management, and the various explanatory comments you added are very welcome !
…ates do not split import start dates by data types
if an error occurs while fetching data, the whole data batch is skipped (same behavior as Alerts import)
Powlinett
removed
the
do not merge
Proposed changes
FLASHPOINT_IMPORT_CCM_ALERTSandFLASHPOINT_FRESH_CCM_ALERTS_ONLYenv/config varsimport_start_dateor connector's state last importCompromisedCredentialSightingmodel and its submodelscredential-sightingfrom Flashpoint (aka CCM Alerts) since defined dateCompromisedCredentialSightingtostix2.Incidentand its related SCOs/SDOslast_rundatetimes by type of imports in connector's stateRelated issues
Checklist