[CrowdStrike] Add motivations and adversary type as labels on IntrusionSet

external-import/crowdstrike/src/crowdstrike_feeds_connector/actor/builder.py

@@ -107,6 +107,7 @@ def _create_intrusion_set(self) -> IntrusionSet:
         aliases = self._get_aliases()
         primary_motivation, secondary_motivations = self._get_motivations()
         external_references = self._create_external_references()
+        labels = self._get_labels()
 
         return create_intrusion_set(
             self.actor["name"],
@@ -117,11 +118,35 @@ def _create_intrusion_set(self) -> IntrusionSet:
             last_seen=self.last_seen,
             primary_motivation=primary_motivation,
             secondary_motivations=secondary_motivations,
+            labels=labels,
             confidence=self.confidence_level,
             external_references=external_references,
             object_markings=self.object_markings,
         )
 
+    def _get_labels(self) -> list[str] | None:
+        labels: list[str] = []
+
+        actor_motivations = self.actor.get("motivations")
+        if isinstance(actor_motivations, list):
+            for motivation in actor_motivations:
+                if isinstance(motivation, Mapping):
+                    value = str(
+                        motivation.get("value") or motivation.get("slug") or ""
+                    ).strip()
+                else:
+                    value = str(motivation).strip()
+                if value:
+                    labels.append(value)
+
+        actor_type = self.actor.get("actor_type")
+        if actor_type:
+            actor_type_str = str(actor_type).strip()
+            if actor_type_str:
+                labels.append(actor_type_str)
+
+        return labels or None
+
     def _get_description(self) -> str | None:
         actor = self.actor
 

external-import/crowdstrike/src/crowdstrike_feeds_connector/related_actors/builder.py

@@ -253,6 +253,22 @@ def _create_intrusion_set_from_actor_entity(
                 )
             )
 
+        # Labels: raw CrowdStrike motivation values and actor_type
+        labels: list[str] = []
+        if isinstance(motivations_raw, list):
+            for mot in motivations_raw:
+                if isinstance(mot, Mapping):
+                    val = str(mot.get("value") or mot.get("slug") or "").strip()
+                else:
+                    val = str(mot).strip()
+                if val:
+                    labels.append(val)
+        actor_type = actor.get("actor_type")
+        if actor_type:
+            actor_type_str = str(actor_type).strip()
+            if actor_type_str:
+                labels.append(actor_type_str)
+
         return create_intrusion_set(
             name,
             created_by=created_by,
@@ -263,6 +279,7 @@ def _create_intrusion_set_from_actor_entity(
             goals=goals or None,
             primary_motivation=primary_motivation,
             secondary_motivations=secondary_motivations or None,
+            labels=labels or None,
             confidence=confidence,
             external_references=external_references or None,
             object_markings=object_markings,