Deprecate and remove TalosReputation. Closes #3451#3559
Deprecate and remove TalosReputation. Closes #3451#3559cipherBT wants to merge 1 commit intointelowlproject:developfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR removes the deprecated TalosReputation analyzer and associated runtime hooks (cron, visualizer, tests), and adds migrations to clean up Talos-related configuration data to prevent runtime failures now that the upstream Talos blocklist is unavailable.
Changes:
- Replace the Talos analyzer implementation with a minimal stub to keep historical migrations importable.
- Remove TalosReputation from cron scheduling, visualizer output, and unit tests.
- Add data migrations to remove TalosReputation from playbooks and delete Talos-related AnalyzerConfig/PythonModule/PeriodicTask records.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
tests/test_crons.py |
Removes talos import from cron-related tests. |
tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_talos.py |
Deletes Talos analyzer unit test. |
docker/scripts/cron/update_repositories |
Removes TalosReputation update_analyzer cron entry. |
api_app/visualizers_manager/visualizers/ip_reputation_services.py |
Removes TalosReputation visualizer section/call from the IP reputation page. |
api_app/playbooks_manager/migrations/0067_remove_talos_from_playbooks.py |
Data migration to remove TalosReputation from playbooks and runtime_configuration. |
api_app/analyzers_manager/observable_analyzers/talos.py |
Replaces Talos analyzer with a stub that raises a deprecation/removal exception. |
api_app/analyzers_manager/migrations/0180_remove_talos_reputation.py |
Data migration to delete TalosReputation AnalyzerConfig/PythonModule and related celery-beat tasks/schedules. |
Comments suppressed due to low confidence (1)
tests/test_crons.py:20
- The
talosmodule is removed from the observable analyzers import list, but this file still definestest_talos_updater()(later in the file) which callstalos.Talos.update(). With this import removed (and TalosReputation being deprecated), the test will error. Please remove/disable the Talos updater test (and any Talos-specific assertions) as part of the Talos removal.
from api_app.analyzers_manager.observable_analyzers import (
feodo_tracker,
greynoise_labs,
ja4_db,
maxmind,
phishing_army,
tor,
tor_nodes_danmeuk,
tweetfeeds,
)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
c5b563f to
7c2ea8b
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
7c2ea8b to
482f279
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
api_app/analyzers_manager/migrations/0180_remove_talos_reputation.py
Outdated
Show resolved
Hide resolved
api_app/playbooks_manager/migrations/0067_remove_talos_from_playbooks.py
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
b5ea0c4 to
482f279
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
482f279 to
27f5536
Compare
(Please add to the PR name the issue/s that this PR would close if merged by using a Github keyword. Example:
<feature name>. Closes #999. If your PR is made by a single commit, please add that clause in the commit too. This is all required to automate the closure of related issues.)Description
Closes #3451. Deprecates and removes the TalosReputation analyzer. The Cisco Talos third party blocklist it relied upon is no longer available, causing runtime errors during investigations.
Changes:
Replaced talos.py with a minimal stub for migration compatibility
Deleted test_talos.py unit tests
Removed talos import from tests/test_crons.py
Removed talos() visualizer method and its call from ip_reputation_services.py
Removed update_analyzer TalosReputation cron job from docker/scripts/cron/update_repositories
Added migration 0180_remove_talos_reputation.py to delete AnalyzerConfig, PythonModule, PeriodicTask, and orphaned schedules
Added migration 0067_remove_talos_from_playbooks.py to remove TalosReputation from playbook.
Type of change
Please delete options that are not relevant.
Checklist
develop(https://intelowlproject.github.io/docs/IntelOwl/contribute/#how-to-create-a-datamodel)
# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.DeepSource,Django Doctorsor other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.Important Rules