Skip to content

fix: use Intel 471 global search for attribute enrichment - #1008

Draft
adulau wants to merge 1 commit into
mainfrom
fix/intel471-global-search-796
Draft

adulau wants to merge 1 commit into
mainfrom
fix/intel471-global-search-796

Conversation

@adulau

@adulau adulau commented Oct 26, 2026

Copy link
Copy Markdown
Member

Fixes #796.

The module currently calls /v1/iocs, which misses matches in other Intel 471 datasets. Switch to /v1/search?text=<attribute value> using the existing PyIntel471 client. A match in indicators, reports, posts or news now produces freetext even when iocTotalCount is zero.

  • URL-encode attribute values because PyIntel471 builds its query string by interpolation.
  • Strip uid fields recursively across all returned collections, preserving real hash fields.
  • Keep the existing email/authkey configuration, supported attribute types and freetext output.
  • Return module errors for missing credentials, failed API requests and malformed responses.

The endpoint and text parameter follow Intel 471's Global Search documentation; collection handling follows its SearchSchema.

Validation: 42 regression tests pass on Python 3.12 with PyIntel471 0.1.1, exercising the real client's prepared HTTP requests with the transport mocked. Coverage includes every supported input type, URL/email encoding, non-IOC results, nested UID cleanup, empty results and API failures. isort, flake8, Black formatting through its Python API, and git diff --check pass.

No live Intel 471 credentials were available. Before merging, validate an IOC known to exist in malware intelligence or news but absent from the IOC collection. Global search remains limited to the account's entitlements and the API's default first page; this change does not add pagination.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bad endpoint in misp_modules/modules/expansion/intel471.py

1 participant