[recordedfuture-enrichment] add threat actor to intrusion set config

[mariot]

Proposed changes

Related issues

• Closes [Recorded Future Enrichment] RF Enrichment connector creates Threat Actors instead of Intrusion Sets #4753

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[Copilot]

Pull request overview

This PR adds a configuration option to convert Recorded Future Threat Actor entities to Intrusion Set entities instead of Threat Actor Group entities during observable enrichment. This addresses issue #4753 by providing flexibility in how threat actor data is represented in OpenCTI.

Key Changes

• Added threat_actor_to_intrusion_set boolean configuration parameter with a default value of False
• Updated observable enrichment logic to conditionally create IntrusionSet objects when the flag is enabled
• Extended relationship matching to include IntrusionSet entities alongside existing threat-related entities

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
conftest.py	Added test fixture configuration for the new threat_actor_to_intrusion_set parameter
enrich_observable.py	Implemented conditional logic to create IntrusionSet instead of ThreatActorGroup based on configuration
rf_connector.py	Passed the new configuration parameter to ObservableEnricher and improved TLP level type safety
config_loader.py	Defined the new threat_actor_to_intrusion_set configuration field with validation
config.yml.sample	Added commented-out example of the new configuration option
docker-compose.yml	Added commented-out environment variable example
README.md	Documented the new configuration parameter with usage warnings
.env.sample	Added commented-out environment variable example

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Corrected spelling of 'Theat' to 'Threat'.

Suggested change

	| Theat Actor to Intrusion Set | threat_actor_to_intrusion_set | `RECORDED_FUTURE_THREAT_ACTOR_TO_INTRUSION_SET` | `False` | no | Converts all Recorded Future Threat Actors to STIX Object "Intrusion Set" instead of "Threat Actor". DO NOT USE unless you **really** know what you're doing. |
	| Threat Actor to Intrusion Set | threat_actor_to_intrusion_set | `RECORDED_FUTURE_THREAT_ACTOR_TO_INTRUSION_SET` | `False` | no | Converts all Recorded Future Threat Actors to STIX Object "Intrusion Set" instead of "Threat Actor". DO NOT USE unless you **really** know what you're doing. |