[romain-filigran]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

Description

New major version of the OpenCTI pack (3.0.0), contributed by Filigran, the company behind OpenCTI.

This PR supersedes #43522, which was closed for inactivity. It is rebased on the current master as a single commit, and it addresses the review comments of #43522 (pre-commit failures, context paths, defaultValue, date formats, release notes wording, unit tests).

Reputation commands (new)

• Added the ip, domain, email, url and file reputation commands.
  • The value is looked up in the OpenCTI observables (exact value, exact hash for files) and indicators (exact STIX pattern).
  • The DBot score is calculated from the OpenCTI score of the indicator (x_opencti_score): good up to the Suspicious score threshold (default 20), suspicious up to the Malicious score threshold (default 70), malicious above it, unknown when the value is unknown to OpenCTI. The default thresholds give the same verdicts as the FeedOpenCTI pack.
  • The relationships of the observable and of the indicator are returned in the context and the readable output, and as XSOAR relationships (EntityRelationship) when Create relationships is enabled.
  • The readable output links the indicator, the observable and the related entities to their OpenCTI page.
  • Standard context outputs (IP, Domain, Account.Email, URL, File, DBotScore) plus OpenCTI.Observable and OpenCTI.Indicator.
• New integration parameters: Source Reliability, Suspicious score threshold, Malicious score threshold and Create relationships.

Creation commands (new)

• opencti-malware-create, opencti-vulnerability-create, opencti-intrusion-set-create, opencti-threat-actor-group-create, opencti-campaign-create, opencti-grouping-create, opencti-report-create and opencti-incident-response-create.
• opencti-add-object-to-container: adds an object to a report, a grouping, a case-incident, a case-rfi or a case-rft.

Fixes

• opencti-observable-field-update failed with recent pycti versions (update_field now expects an input list). It is fixed.

Docker image and compatibility

• The integration uses the dedicated image demisto/opencti:1.0.0.7499058 (pycti 6.9.0) instead of demisto/vendors-sdk.
• demisto/vendors-sdk:1.0.0.10120494, used by version 2.0.7, ships pycti 7.260529.0, which is not compatible with OpenCTI 6 platforms: users on OpenCTI 6 could not use version 2.0.7. pycti 6.9.0 works with OpenCTI 6.9 and with the current OpenCTI 7 versions.
• The integration description now states "Compatible with OpenCTI 6.9 and later versions" (it previously mentioned OpenCTI 4.X and 5.X).

Testing

• Unit tests for all the new commands and helpers (165 tests), passing with pycti 6.9.0 and 7.260529.0.
• Every command of the integration (39) was run against real OpenCTI 6.9.0 and 7.261.008 platforms, which are the versions now documented in the README. The README examples come from these runs.
• The reputation commands were tested on a Cortex XSOAR 8 tenant with TIM, both from the CLI and through incident enrichment.
• demisto-sdk validate -g and demisto-sdk pre-commit (including the docker hooks) pass locally.

Notes for reviewers

• Packs/OpenCTI/.secrets-ignore lists test values flagged by the secrets scanner: documentation IP (203.0.113.42), test hashes, a GraphQL pagination cursor and context paths.

Must have

• Tests
• Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-18820

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Hi @romain-filigran, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

[content-bot]

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[romain-filigran]

Hi @ilappe,

Sorry for the long silence on #43522, and thank you for your patience.

This PR resumes and continues the work of #43522, which was closed for inactivity. It is based on the current master as a single commit, since the base branch of #43522 is now several months behind.

It addresses the review comments of #43522 (pre-commit failures, context paths, defaultValue, date formats, release notes wording, unit tests) and adds:

• the ip, domain, email, url and file reputation commands (with relationships and configurable score thresholds),
• a fix for opencti-observable-field-update,
• tests against OpenCTI 6.9.0 and 7.261.

It is ready for review.

Thanks

[ilappe]

@marketplace-ai-reviewer start review

[marketplace-ai-reviewer]

🤖 Analysis started. Please wait for results...

[marketplace-ai-reviewer]

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

[marketplace-ai-reviewer]

Hi there, thank you for your contribution!

Overall, the updates look great, but there are a few key areas that need attention across the pack:

• YAML & Documentation: Fix schema casing issues (use lowercase defaultvalue) and standardize parameter descriptions in the YAML, then regenerate the README using demisto-sdk generate-docs to fix missing table columns and command examples.
• Release Notes & Code: Ensure command references in the release notes follow Cortex XSOAR entity styling (***command***), use safe argument parsing via arg_to_number(), and log full tracebacks for errors.
• Assets & Config: Clean up the entry in .secrets-ignore to only list the secret value, and consider adjusting the integration logo for better contrast and legibility.

Please take a look at these updates, and let us know once you've had a chance to review them!

Additionally, please address the following file-level notes:

• Packs/OpenCTI/Integrations/OpenCTI/OpenCTI_image.png: The logo suffers from low contrast and legibility issues. The 'OpenCTI' text is dark blue against a dark background, making it difficult to read, and the subtext 'by Filigran' is unreadable at small scale. Please consider updating the image with higher-contrast text and removing or simplifying small subtext so the logo remains clearly legible at integration thumbnail sizes.

@ilappe please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

[marketplace-ai-reviewer]

Suggested change

	defaultValue: "false"
	defaultvalue: "false"

Cortex XSOAR YAML schema keys are case-sensitive. Please use defaultvalue in lowercase instead of defaultValue.

[marketplace-ai-reviewer]

Suggested change

	defaultValue: grouping
	defaultvalue: grouping

Cortex XSOAR YAML schema keys are case-sensitive. Please use defaultvalue in lowercase instead of defaultValue.

[romain-filigran]

Hi @ilappe,

Most of the comments are now fixed and pushed (8 commits), with a reply on each thread.

I have one question about the two defaultValue comments (opencti-malware-create / is_family and opencti-add-object-to-container / container_type): should we really change defaultValue to defaultvalue there?

As far as I understand, these are command arguments, and the demisto-sdk schema uses defaultValue (camelCase) for command arguments, while the lowercase defaultvalue is used for integration configuration parameters. The 17 other command arguments of this integration, and the command arguments of the other integrations in the repository, all use defaultValue. With defaultvalue, the default would most likely be ignored, for example by demisto-sdk generate-docs, which reads defaultValue.

Could you confirm which one you expect? I’m happy to change it if needed.

Thanks!