feat(modat-enrichment): add Modat internal enrichment connector (#6829)#6830
Open
RT-MDT wants to merge 1 commit into
Open
feat(modat-enrichment): add Modat internal enrichment connector (#6829)#6830RT-MDT wants to merge 1 commit into
RT-MDT wants to merge 1 commit into
Conversation
Contributor License Agreement✅ CLA signed 💚 Thank you @RT-MDT for signing the Contributor License Agreement! Your pull request can now be reviewed and merged. We appreciate your contribution to Filigran's open source projects! ❤️ This is an automated message from the Filigran CLA Bot. |
Filigran-Automation
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new Modat Magnify internal-enrichment connector to the OpenCTI connectors monorepo, focused on enriching IPv4-Addr observables via GET /host/{ip}/v1 and emitting both structured STIX objects and an optional human-readable summary Note.
Changes:
- Implements a Modat API client with IPv4-only validation and a lenient Pydantic model for parsing host-detail payloads.
- Generates STIX objects (ASN/org, locations, domains, certificates, optional vulnerabilities) plus a stable, idempotent summary Note per observable.
- Adds unit/integration-style tests covering config validation, model coercion/leniency, summary rendering, and end-to-end
process_message()bundle creation.
Reviewed changes
Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| internal-enrichment/modat-enrichment/src/modat_client/api_client.py | Modat HTTP client with IPv4 validation and per-request Authorization header. |
| internal-enrichment/modat-enrichment/src/modat_client/models.py | Lenient Pydantic models for parsing partial/messy Modat host responses. |
| internal-enrichment/modat-enrichment/src/modat_client/init.py | Exposes ModatClient and ModatHost as package API. |
| internal-enrichment/modat-enrichment/src/connector/settings.py | Connector configuration models (OpenCTI + Modat settings). |
| internal-enrichment/modat-enrichment/src/connector/utils.py | Summary rendering + helper parsers/validators (TLS, DNs, domains, banners). |
| internal-enrichment/modat-enrichment/src/connector/converter_to_stix.py | Translates parsed Modat host data into STIX objects + relationships. |
| internal-enrichment/modat-enrichment/src/connector/connector.py | Main enrichment workflow: TLP gating, API query, parsing, STIX emission, idempotent Note. |
| internal-enrichment/modat-enrichment/src/connector/init.py | Connector package exports with lazy import for ModatConnector. |
| internal-enrichment/modat-enrichment/src/main.py | Entrypoint wiring settings → helper → connector run. |
| internal-enrichment/modat-enrichment/src/requirements.txt | Runtime dependencies (pycti, pydantic, requests, connectors-sdk). |
| internal-enrichment/modat-enrichment/tests/conftest.py | Test path setup for importing connector sources. |
| internal-enrichment/modat-enrichment/tests/test_main.py | End-to-end tests for process_message() + ModatClient validation/SSRF defense. |
| internal-enrichment/modat-enrichment/tests/test-requirements.txt | Test dependencies (pytest + runtime requirements include). |
| internal-enrichment/modat-enrichment/tests/tests_connector/test_settings.py | Settings validation tests (valid + invalid cases). |
| internal-enrichment/modat-enrichment/tests/tests_connector/test_models.py | Tests ensuring model leniency/coercion and “never raise” behavior. |
| internal-enrichment/modat-enrichment/tests/tests_connector/test_summary.py | Tests for summary note rendering across service types and caps. |
| internal-enrichment/modat-enrichment/README.md | Connector documentation (config, deployment, behavior, STIX output overview). |
| internal-enrichment/modat-enrichment/docs/STIX.md | Detailed STIX output documentation and bundle inspection guidance. |
| internal-enrichment/modat-enrichment/Dockerfile | Alpine-based container build for the connector. |
| internal-enrichment/modat-enrichment/entrypoint.sh | Container entrypoint to run the connector. |
| internal-enrichment/modat-enrichment/docker-compose.yml | Example compose service definition and env vars. |
| internal-enrichment/modat-enrichment/config.yml.sample | Sample config.yml for manual deployments. |
| internal-enrichment/modat-enrichment/.dockerignore | Docker ignore rules for metadata, caches, configs. |
| internal-enrichment/modat-enrichment/metadata/connector_manifest.json | Connector manifest metadata for OpenCTI ecosystem integration. |
Comment on lines
+274
to
+281
| stix_domain = stix2.DomainName( | ||
| value=domain["value"], | ||
| custom_properties={ | ||
| "x_opencti_created_by_ref": self.author["id"], | ||
| "x_opencti_score": self.default_score, | ||
| "x_opencti_labels": ["modat", "modat-enriched"], | ||
| }, | ||
| ) |
Comment on lines
+343
to
+354
| stix_domain = stix2.DomainName( | ||
| value=san_domain, | ||
| custom_properties={ | ||
| "x_opencti_created_by_ref": self.author["id"], | ||
| "x_opencti_score": self.default_score, | ||
| "x_opencti_labels": [ | ||
| "modat", | ||
| "modat-enriched", | ||
| "certificate-san", | ||
| ], | ||
| }, | ||
| ) |
Comment on lines
+270
to
+272
| ## Recommended Next Step | ||
|
|
||
| Add an end-to-end test for `process_message()` driven by saved `GET /host/{ip}/v1` JSON fixtures. A captured-bundle assertion turns this document from "derived from code" into "derived from tested output". |
| @@ -0,0 +1,3 @@ | |||
| # Main dependencies needs to be installed | |||
Internal-enrichment connector for the Modat Magnify host API (GET /host/{ip}/v1). Enriches IPv4-Addr observables with ASN, organization, geolocation, resolving domains, X.509 certificates, optional CVEs, and a summary note. Parses the API response into a typed pydantic model; includes unit tests and a STIX output reference.
RT-MDT
force-pushed
the
feat/modat-enrichment
branch
from
5163fc2 to
2c6d624
Compare
Comment on lines
+274
to
+281
| stix_domain = stix2.DomainName( | ||
| value=domain["value"], | ||
| custom_properties={ | ||
| "x_opencti_created_by_ref": self.author["id"], | ||
| "x_opencti_score": self.default_score, | ||
| "x_opencti_labels": ["modat", "modat-enriched"], | ||
| }, | ||
| ) |
Comment on lines
+343
to
+354
| stix_domain = stix2.DomainName( | ||
| value=san_domain, | ||
| custom_properties={ | ||
| "x_opencti_created_by_ref": self.author["id"], | ||
| "x_opencti_score": self.default_score, | ||
| "x_opencti_labels": [ | ||
| "modat", | ||
| "modat-enriched", | ||
| "certificate-san", | ||
| ], | ||
| }, | ||
| ) |
Comment on lines
+1
to
+3
| # Main dependencies needs to be installed | ||
| -r ../src/requirements.txt | ||
| pytest==8.4.2 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Internal-enrichment connector for the Modat Magnify host API (
GET /host/{ip}/v1). EnrichesIPv4-Addrobservables with ASN, organization, geolocation, resolving domains, X.509 certificates, optional CVEs, and a summary note. Parses the API response into a typed pydantic model; includes unit tests and a STIX output reference.Proposed changes
IPv4-Addr(oneGET /host/{ip}/v1call per observable).Related issues
Checklist