[Recorded Future] Formatting error prevents incident creation

[Lhorus6]

Description

Alerts on Recorded Future side are not created in OpenCTI (as Incident) because a formatting error is raised.

Traceback (most recent call last): File "/opt/opencti-connector-recorded-future/rflib/rf_playbook_alerts.py", line 117, in run self.create_incident_from_playbook_alert_identity_novel_exposures( File "/opt/opencti-connector-recorded-future/rflib/rf_playbook_alerts.py", line 421, in create_incident_from_playbook_alert_identity_novel_exposures summary_content + "\n" + make_markdown_table(table_markdownsub) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/opencti-connector-recorded-future/rflib/make_markdown_table.py", line 14, in make_markdown_table markdown += f"| {' | '.join(entry)} |{nl}" ^^^^^^^^^^^^^^^^^ TypeError: sequence item 1: expected str instance, list found

Environment

OCTI 6.4.4

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Run the RF connector with this configuration

                ALERT_DEFAULT_OPENCTI_SEVERITY: 'P3 - low'
                ALERT_ENABLE: 'False'
                ALERT_PRIORITY_ALERTS_ONLY: 'True'
                CONNECTOR_DURATION_PERIOD: PT5M
                CONNECTOR_NAME: recordedfuture-playbook-alerts
                CONNECTOR_SCOPE: ipv4-addr,ipv6-addr,vulnerability,domain,url,StixFile
                CONNECTOR_TYPE: EXTERNAL_IMPORT
                PLAYBOOK_ALERT_DEBUG: 'False'
                PLAYBOOK_ALERT_ENABLE: 'True'
                PLAYBOOK_ALERT_SEVERITY_THRESHOLD_CODE_REPO_LEAKAGE: 'Informational'
                PLAYBOOK_ALERT_SEVERITY_THRESHOLD_DOMAIN_ABUSE: 'Moderate'
                PLAYBOOK_ALERT_SEVERITY_THRESHOLD_IDENTITY_NOVEL_EXPOSURES: 'Informational'
                RECORDED_FUTURE_INITIAL_LOOKBACK: '240'
                RECORDED_FUTURE_INSIKT_ONLY: 'True'
                RECORDED_FUTURE_LAST_PUBLISHED_NOTES: '24'
                RECORDED_FUTURE_PERSON_TO_TA: 'True'
                RECORDED_FUTURE_PULL_ANALYST_NOTES: 'False'
                RECORDED_FUTURE_PULL_RISK_LIST: 'False'
                RECORDED_FUTURE_PULL_SIGNATURES: 'True'
                RECORDED_FUTURE_PULL_THREAT_MAPS: 'False'
                RECORDED_FUTURE_RISKLIST_RELATED_ENTITIES: 'Malware,Hash,URL,Threat Actor,MitreAttackIdentifier'
                RECORDED_FUTURE_RISK_AS_SCORE: 'True'
                RECORDED_FUTURE_RISK_LIST_THRESHOLD: '70'
                RECORDED_FUTURE_RISK_THRESHOLD: '58'
                RECORDED_FUTURE_TA_TO_INTRUSION_SET: 'True'
                RECORDED_FUTURE_TLP: Green
                RECORDED_FUTURE_TOKEN: <your_token>
                RECORDED_FUTURE_TOPIC: VTrvnW,g1KBGl,ZjnoP0,aDKkpk,TXSFt5,UrMRnT,TXSFt3,TXSFt4,ZjnoP2,hPX1cE,UX0YlU,TXSFt1,TXSFt2,UZmDut,irEim2,VlIhvG