Skip to content

Conversation

@siddharths1-metron
Copy link

Proposed changes

  • This new version of Doppel OpenCTI connector converts doppel alerts to STIX 2.1 Observables.
  • Converts the Observables into Indicators if the alert is actioned/taken_down.
  • Revokes the Indicator if alert is mark as unresolved from actioned/taken_down state.

Related issues

  • 4385

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key.
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

@Ninoxe
Copy link
Contributor

Ninoxe commented Dec 10, 2025

Hi @siddharths1-metron

Thank you for your PR.

There are a lot of files that have nothing to do with Doppel. Can you modify it so that only Doppel files are included in the PR?

@Ninoxe Ninoxe changed the title Doppel-OpenCTI v1.1.0 Converting Doppel Alerts to STIX 2.1 Observables [Doppel] Converting Doppel Alerts to STIX 2.1 Observables Dec 10, 2025
@romain-filigran romain-filigran added partner used to identify PR from patner filigran verify Use to identify PR of connector Verified labels Dec 12, 2025
tanvik-metron and others added 20 commits December 14, 2025 19:12
…hance note creation with indicator and observable references, and adjust score calculation logic.
…revamped convert_to_stix function into multiple sub functions based on functionality.
@siddharths1-metron
Copy link
Author

siddharths1-metron commented Dec 14, 2025

Hi @siddharths1-metron

Thank you for your PR.

There are a lot of files that have nothing to do with Doppel. Can you modify it so that only Doppel files are included in the PR?

Hello @Ninoxe I have modified the PR, please take a look thanks!
Also I did run isort --profile black . inside external-import/doppel do you have any idea why the check is still failing?

@siddharths1-metron
Copy link
Author

siddharths1-metron commented Dec 18, 2025

Hello @Ninoxe, any update on this? Thanks.

@Ninoxe
Copy link
Contributor

Ninoxe commented Dec 18, 2025

Hi @siddharths1-metron
Thank you for your PR.
There are a lot of files that have nothing to do with Doppel. Can you modify it so that only Doppel files are included in the PR?

Hello @Ninoxe I have modified the PR, please take a look thanks! Also I did run isort --profile black . inside external-import/doppel do you have any idea why the check is still failing?

Hi @siddharths1-metron !

Did you try to run the command just inside external-import and not inside the connector like isort --profile black doppel?

@siddharths1-metron
Copy link
Author

Hello @Ninoxe any update on this? I did run the cmd as suggested. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

filigran verify Use to identify PR of connector Verified partner used to identify PR from patner

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants