Skip to content

[orange-cyberdefense-v3] external-import connector update#5872

Merged
Ninoxe merged 1 commit intoOpenCTI-Platform:masterfrom
cert-orangecyberdefense:external-import-release
Mar 31, 2026
Merged

[orange-cyberdefense-v3] external-import connector update#5872
Ninoxe merged 1 commit intoOpenCTI-Platform:masterfrom
cert-orangecyberdefense:external-import-release

Conversation

@ocd-acauchy
Copy link
Copy Markdown
Contributor

@ocd-acauchy ocd-acauchy commented Feb 27, 2026

Proposed changes

  • chore: bump version of datalake python library
  • chore: change default scope
  • fix: bug with import of some identity objects
  • doc: update screenshots for v7

Related issues

N/A

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key.
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

I also requested the deletion of the old connector in a dedicated PR since it might have implications on your side: #5871

Closes #6119

@filigran-cla-bot filigran-cla-bot bot added the cla:pending CLA signature required label Feb 27, 2026
@filigran-cla-bot
Copy link
Copy Markdown

filigran-cla-bot bot commented Feb 27, 2026

Contributor License Agreement

CLA signed 💚

Thank you @ocd-acauchy for signing the Contributor License Agreement! Your pull request can now be reviewed and merged.

We appreciate your contribution to Filigran's open source projects! ❤️

This is an automated message from the Filigran CLA Bot.

@filigran-cla-bot filigran-cla-bot bot removed the cla:pending CLA signature required label Feb 27, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the orange-cyberdefense-v3 external-import connector to align with Orange Cyberdefense Datalake v3 changes by bumping the Datalake client dependency, adjusting connector defaults, fixing an identity-import edge case, and refreshing documentation screenshots.

Changes:

  • Bump datalake-scripts from 3.0.0rc7 to 3.0.0.
  • Change the connector’s default scope string and harden identity handling by avoiding KeyErrors on missing identity fields.
  • Refresh README screenshot section and update included media assets.

Reviewed changes

Copilot reviewed 3 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
external-import/orange-cyberdefense-v3/src/requirements.txt Updates Datalake client dependency to the stable 3.0.0 release.
external-import/orange-cyberdefense-v3/src/main.py Adjusts default connector scope; fixes identity object handling by using safe dict access for optional fields.
external-import/orange-cyberdefense-v3/README.md Updates screenshot section headings and switches report screenshot reference to the new image.
external-import/orange-cyberdefense-v3/media/Indicator_2.png Updates screenshot asset used by the README.
external-import/orange-cyberdefense-v3/media/Report.png Screenshot asset included in PR changes (part of screenshot refresh/transition).
external-import/orange-cyberdefense-v3/media/Report_2.png Screenshot asset included in PR changes (part of screenshot refresh/transition).

}
config["connector"]["type"] = "EXTERNAL_IMPORT"
config["connector"]["scope"] = "ocd"
config["connector"]["scope"] = "Orange-Cyberdefense"
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

config["connector"]["scope"] is hard-coded after merging config, so any user-provided connector.scope in config.yml/env is silently overwritten. Most connectors treat scope as a configurable value (commonly a lowercase slug, e.g. threatmatch, socprime), so it would be better to set this as a default (only when missing) and/or keep the previous value unless explicitly configured.

Suggested change
config["connector"]["scope"] = "Orange-Cyberdefense"
# Only set the default scope if none was provided by the user
config["connector"].setdefault("scope", "Orange-Cyberdefense")

Copilot uses AI. Check for mistakes.
@romain-filigran romain-filigran added partner used to identify PR from patner labels Mar 17, 2026
Copy link
Copy Markdown
Contributor

@Ninoxe Ninoxe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @ocd-acauchy and thanks for your work!
Same for the previous PR (Remove old connector), it's all good except a little conflict with master to fix and I will approve+merge.

* chore: bump version of datalake python library
* chore: change default scope
* fix: bug with import of some identity objects
* doc: update screenshots for v7
@ocd-acauchy ocd-acauchy force-pushed the external-import-release branch from f2516bb to 6effc39 Compare March 31, 2026 14:17
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 31, 2026

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 0.09%. Comparing base (6575c4e) to head (6effc39).
⚠️ Report is 6 commits behind head on master.

Files with missing lines Patch % Lines
external-import/orange-cyberdefense-v3/src/main.py 0.00% 1 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (6575c4e) and HEAD (6effc39). Click for more details.

HEAD has 88 uploads less than BASE
Flag BASE (6575c4e) HEAD (6effc39)
connectors 89 1
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #5872       +/-   ##
==========================================
- Coverage   39.22%   0.09%   -39.13%     
==========================================
  Files        2082    1626      -456     
  Lines      124471   97657    -26814     
==========================================
- Hits        48819      94    -48725     
- Misses      75652   97563    +21911     
Flag Coverage Δ
baseline 0.00% <0.00%> (ø)
connectors 96.90% <ø> (+22.61%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

@Ninoxe Ninoxe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All good, thank you!

@Ninoxe Ninoxe merged commit c473d2b into OpenCTI-Platform:master Mar 31, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

partner used to identify PR from patner

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[orange-cyberdefense-v3] external-import connector update

5 participants