Repository navigation
fix(types): treat offline-alert and inventory source_error codes as analyst sentences - #16
Merged
Merged
Conversation
The public API now sends NetworkSubmissionOnlyAlerts.scope and .source as one analyst sentence each, or null, in place of the codes submission_unattributed and pinned_offline_eve. Make both fields optional so get_network_summary() parses a null value, and document them as sentences that callers should not match on.
The public API sends KillchainInventoryCoverage.source_error as one analyst sentence, or null, for every cause, for example "Not available because the file capture folder was missing" for sidecar_dir_missing. KillchainInventorySourceError still listed the internal codes. Make it plain str and document the field as free text that callers should not match on. Parsing is unchanged.
batuhanisildak-malwation
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The public API no longer sends internal codes in two groups of fields. The SDK still typed and documented both groups as codes.
Offline-scan alerts. Malwation/threatzone#2335 changed
submissionOnlyAlerts.scopeand.sourceinGET /submissions/:uuid/network/summary. They used to be the documented codessubmission_unattributedandpinned_offline_eve. Now each one is an analyst sentence ornull:The SDK declared both fields as required
str, so anullwould makeget_network_summary()fail validation.Inventory
source_error. InGET /submissions/:uuid/killchain,artifactInventoryCoverage.sourceErroris one sentence for every cause, ornull:sidecar_dir_missing→ "Not available because the file capture folder was missing".KillchainInventorySourceErrorstill listed eight codes.Changes
NetworkSubmissionOnlyAlerts.scopeand.sourceare nowstr | None = None. Their docstrings call them analyst sentences, not codes.KillchainInventorySourceErroris nowstr. The exported name stays, so imports do not break. Its docstring and thesource_errordocstring describe free text and give the example sentence. Parsing is unchanged: any string still parses.docs/TYPES.md: both entries describe sentences orNoneand no longer list codes.CHANGELOG.md: added two Unreleased → Changed entries.scope/sourceand a sentence insource_error.Nothing else in
src/,docs/,examples/or the README matches on the old code values.attribution_reason,availability.reasonandretention_detailwere alreadystr | None, and their docs list no codes.Verification
All four CI gates pass locally:
uv run ruff check src/ tests/: clean.uv run ruff format --check src/ tests/: clean.uv run mypy src/threatzone: no issues.uv run pytest tests/: 1407 passed.