Skip to content

[Connectors] Introduce CTIConnector to standardize CTI connectors and support data model enrichment - #3891

Open
sanjib2006 wants to merge 5 commits into
gsoc-2026/post-mid-connectorsfrom
gsoc-2026/cti-connector-base-class
Open

[Connectors] Introduce CTIConnector to standardize CTI connectors and support data model enrichment#3891
sanjib2006 wants to merge 5 commits into
gsoc-2026/post-mid-connectorsfrom
gsoc-2026/cti-connector-base-class

Conversation

@sanjib2006

@sanjib2006 sanjib2006 commented Aug 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Closes #3890

Description

  • Adds CTIConnector: Introduces a new base class extending Connector to standardize CTI connectors (MISP, OpenCTI, and YETI).
  • Standardizes Observable Metadata: Provides reusable properties for observable name, value, classification, hash type, and IP version.
  • Unifies Job Context: Standardizes extraction of analysis URLs, tags, and executed analyzers.
  • Supports Data Model Enrichment: Adds optional properties for verdicts, malware families, kill chain phases, reliability, related threats, and external references.
  • Refactors Connectors: Updates MISP, OpenCTI, and YETI to inherit from CTIConnector, replacing duplicated logic with standardized properties.
  • Adds Unit Tests: Includes comprehensive tests for metadata extraction, job context, and data model enrichment.

Type of change

  • New feature (non-breaking change which adds functionality).

Checklist

  • I have read and understood the rules about how to Contribute to this project
  • The pull request is for the branch gsoc-2026/post-mid-connectors
  • I have added tests for the feature/bug I solved (see tests folder). All the tests (new and old ones) gave 0 errors.
  • After you had submitted the PR, if DeepSource, Django Doctors or other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.
  • I have reviewed and verified any LLM-generated code included in this PR. Also, I have explicitly stated that I have used LLMs in this PR.

@sanjib2006

sanjib2006 commented Aug 2, 2026

Copy link
Copy Markdown
Member Author

Hey @mlodic,
This PR introduces a new CTIConnector base class.

I would like to get your insights and thoughts over the changes I have done in this PR.

CTIConnector class

  • base class for CTI connectors
  • has observable metadata like (observable_name, observable_value, analysis_url etc.) and data model enrichment properties like (has_data_model, evaluation, reliability etc.) -- please check the changes done in api_app/connectors_manager/classes.py
  • It then generates a get_enrichment_summary based on available enrichment data

The connectors are inheriting the above class and then sending enrichment data accordingly.

MISP

  • I have sent these as misp tags as you can see below
image

OpenCTI

  • sent as labels
image

YETI

  • sent with the context
image

I would like to know if this is fine or I should send it some other way.
I have also updated and added new tests, will add it through a new commit soon.

Also, will fix any deepsource errors, for now just want your thoughts over the changes I have done.

@sanjib2006 sanjib2006 linked an issue Aug 2, 2026 that may be closed by this pull request
[Connectors] Feature: Add a Shared CTIConnector Base Class with Data Model Enrichment #3890
Open
mlodic
mlodic reviewed Aug 3, 2026
View reviewed changes

@mlodic mlodic left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

broadly speaking I like how the structure of the connectors is more simple now.

Comment thread api_app/connectors_manager/connectors/opencti.py Outdated
Comment thread api_app/connectors_manager/connectors/opencti.py Outdated
@sanjib2006

sanjib2006 commented Aug 4, 2026

Copy link
Copy Markdown
Member Author

Hi @mlodic!
I have updated the source as you asked. Also added new tests and modifications so that the new tests pass.
Here is the screenshot of the connector tests:
image

This PR can be merged now after your final review.

@sanjib2006
sanjib2006 marked this pull request as ready for review August 4, 2026 18:46
@sanjib2006 sanjib2006 mentioned this pull request Aug 4, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mlodic mlodic mlodic left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Connectors] Feature: Add a Shared CTIConnector Base Class with Data Model Enrichment

2 participants

@sanjib2006 @mlodic