Description

During testing, we observed that the RF Enrichment connector is creating entities of type Threat Actor, whereas it should be creating Intrusion Set entities.

Environment

OCTI 6.7.17

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Run the RF Enrichment connector with standard configuration.
2. Launch it on several Observables.
3. Observe that threat entities are created as Threat Actors instead of Intrusion set.

Expected Output

The connector should create Intrusion Set entities (consistent with the STIX standard and the fix previously applied to the RF Import connector).

Actual Output

The connector creates Threat Actor entities.