Feature: OpenCTI Improvements

[jesusgpo]

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

In progess doing test, waiting for paloalto review

Description

• Rename indicators commands to observable commands according to OpenCTI naming the deprecation
  • opencti-get-indicators -> opencti-get-observables
  • opencti-indicator-delete -> opencti-observable-delete
  • opencti-indicator-field-update -> opencti-observable-field-update
  • opencti-indicator-create -> opencti-observable-create
  • opencti-indicator-field-add -> opencti-observable-field-add
  • opencti-indicator-field-remove -> opencti-observable-field-remove
• Develop Incident commands
  • opencti-incident-create
  • opencti-incident-delete
  • opencti-incident-types-list
• Develop indicators commands
  • opencti-indicator-create
  • opencti-indicator-update
  • opencti-indicator-field-add
  • opencti-indicator-field-remove
  • opencti-get-indicators
  • opencti-indicator-types-list
  • opencti-relationship-create: Required to create entities relations

Must have

• Tests
• Documentation

[samuelFain]

@jesusgpo Following our sync on this contribution:

1. Please make sure you sign the Contribution Registration form so I can start my review on this PR.
2. We are currently reviewing the original commands depreciation issue and whether we should keep or completely remove them, I will update you as soon as I have more information.

Thanks!

[jesusgpo]

@jesusgpo Following our sync on this contribution:

1. Please make sure you sign the Contribution Registration form so I can start my review on this PR.
2. We are currently reviewing the original commands depreciation issue and whether we should keep or completely remove them, I will update you as soon as I have more information.

Thanks!

Hi Samuel, I have just completed the form and I filled the description with the commands developed and updated, my next step is develop the tests for the commands

[samuelFain]

@jesusgpo Following our sync on this contribution:

Hi Samuel, I have just completed the form and I filled the description with the commands developed and updated, my next step is develop the tests for the commands

Thanks for the update! I will start reviewing the PR.

[samuelFain]

@jesusgpo You have done amazing work so far!
I reviewed most of the command changes so I'm posting my initial review for them.
I will be reviewing the incident commands (3 commands), test file and other file changes in this PR shortly.
In the meanwhile, please see my comments, some of them might have already been addressed by your latests commits.
Also, it seems like you have a conflict in README.md.

[samuelFain]

@jesusgpo A few more issues that came up when running demisto-sdk pre-commit command on your PR (I strongly suggest you use it as well, more about this command here):

• ruff error code E731:

  Do not assign a lambda expression, use a def.

  For example in: query = lambda *args, **kwargs: None.

  Full error:

  Packs/OpenCTI/Integrations/OpenCTI/OpenCTI_test.py:11:5: E731 Do not assign a lambda expression, use a def
  Found 1 error.

• Getting a mypy linting error where the indicator and main_observable_type arguments have a type of Optional[str] but expects str for this line:
  pattern = build_stix_pattern(indicator, main_observable_type)

  Full error:

  Packs/OpenCTI/Integrations/OpenCTI/OpenCTI.py:935: error: Argument 1 to
  "build_stix_pattern" has incompatible type "Optional[str]"; expected "str"
  [arg-type]
  pattern = build_stix_pattern(indicator, main_observable_type)
  ^~~~~~~~~
  Packs/OpenCTI/Integrations/OpenCTI/OpenCTI.py:935: error: Argument 2 to
  "build_stix_pattern" has incompatible type "Optional[str]"; expected "str"
  [arg-type]
  pattern = build_stix_pattern(indicator, main_observable_type)
  ^~~~~~~~~~~~~~~~~~~~
  Found 2 errors in 1 file (checked 1 source file)

• I also have 3 UTs failing when trying to run them via pytest on the docker container, not sure if there is real issue with them or not, we can wait until the conflict in Packs/OpenCTI/Integrations/OpenCTI/README.md is resolved and then pre-commit will run automatically inside one of this PRs Github actions (also runs the UTs), giving us something to compare with:

  • test_incident_create_command_exception
  • test_incident_types_list_command_exception
  • OpenCTI_test.py::test_incident_create_command_exception_id