Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Flashpoint]: Enhance Flashpoint connector #3293

Merged
merged 2 commits into from
Jan 17, 2025
Merged

[Flashpoint]: Enhance Flashpoint connector #3293

merged 2 commits into from
Jan 17, 2025

Conversation

romain-filigran
Copy link
Member

Proposed changes

Rework of the Flashpoint connector, which solves issues but also improves the way we model and ingest alerts from Proofpoint.

Global

  • Implement the standard scheduling and back-pressure mechanism. Previous "interval" configuration option stay maintained to not introduce breaking change.
  • Generate a work_id per collection to ingest

Flashpoint Alerts

  • Better Modeling of Alerts: Refine the structure used to model Flashpoint alerts in OpenCTI
  • Use a more efficient API to retrieve alerts
  • Consideration of Data Exposure Alerts

Flashpoint Indicators (MISP Feed)

  • No longer import MITRE attack pattern identifiers as labels
  • Align indicator ingestion scheduling

Related issues

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

@SamuelHassine SamuelHassine merged commit 55eb720 into master Jan 17, 2025
4 checks passed
@SamuelHassine SamuelHassine deleted the issue/3279 branch January 17, 2025 08:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants