Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 176b25bcfb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for tag in _records(container, key): | ||
| tag = tag.get("Tag", tag) | ||
| if isinstance(tag, dict) and isinstance(tag.get("name"), str): | ||
| tag["name"].encode("utf-8") | ||
| if tag["name"]: | ||
| names.add(tag["name"]) |
There was a problem hiding this comment.
When an EventTag or AttributeTag record has local=true, this code unwraps the nested Tag and adds its name without checking the association flag, after which the name is sent to Azure as a STIX label or TLP marking. MISP defines local tags as instance-only and states that they are never exported or synchronized (MISP User Guide), so publishing a tagged event can disclose private routing or classification labels; filter local tag associations before aggregating names.
Useful? React with 👍 / 👎.
Use the public misp-stix converter for validated indicator patterns, preserving composite constraints and IP/email direction. Exclude local tag associations from exported labels and markings, and retain the legacy wrapper when the optional converter is unavailable.
176b25b to
c039405
Compare
Existing
export_sentinelworkflows require a local MISP2Sentinel/MISP2Defender installation and return only a boolean result. This adds native Microsoft Sentinel publishing through the STIX objects upload API, available asmode=directinexport_sentineland as a dedicated blockingsentinel_publishaction. Wrapper mode remains the default.Direct publishing uses the public
misp-stixMISPtoSTIX21Parser.parse_misp_attributeAPI and validates the resulting STIX 2.1 pattern. This reuses the mappings already used by the STIX pattern modules, preserves domain/IP and filename/hash conjunctions and IP/email direction, and replaces handwritten pattern paths and escaping. Only normalized type/value andto_ids=trueenter the converter; only the indicator pattern is retained. Converter warnings, errors, ambiguous composites and invalid output are skipped.misp-stixis already included in theallextra; the legacy wrapper remains available without it.The publisher processes supplied IDS-marked event and object attributes, authenticates with server-side Entra client credentials, and sends batches of up to 100 indicators to an explicit workspace. It supports credential-free dry runs, confidence, expiry, deterministic source-revision identities, provenance and TLP markings. Local-only tags are excluded from both labels and markings, including association flags. HTTP 200 indexed validation errors map to individual indicators; uncertain batch outcomes stop later uploads without automatic retries. TLS verification, redirect rejection and fixed commercial-cloud endpoints remain enforced.
Wrapper failures return a workflow error, empty parameters use existing defaults, and subprocess output is not copied to service logs. Both actions reject filtered/extracted payloads because those filters are not applied. The usage guide covers supported inputs, partial publication, API limits, optional dependencies and lifecycle behavior. Patterns changed by the converter produce new IDs; older revisions are not automatically revoked.
Validation:
mainat65b4b71band resolved documentation conflicts while preserving the current module catalog.git diff --checkpassed.No live Azure workspace was used. The target API remains
2024-02-01-preview; deployment requires valid Entra credentials, workspace permissions and preview API availability.