anti 999d3494b4 feat(intel): persist per-provider taxonomy on AttackerIntel for TTP dispatch ...

The 2026-05-02 ship-time audit of the R0054-R0058 intel rule pack found
that AbuseIPDB / GreyNoise / ThreatFox stored only the aggregate verdict
(score / classification / listed-bool) plus the raw response blob. The
TTP IntelLifter expects per-provider taxonomy fields (categories, tags,
threat_types) that were never populated, so R0054 / R0055 / R0057
emitted zero tags in production despite passing unit tests.

Add typed columns: abuseipdb_categories, greynoise_tags, greynoise_name,
feodo_malware_family, threatfox_threat_types, threatfox_ioc_types,
threatfox_malware_families. Each provider now parses the relevant
taxonomy out of the upstream response and writes it through
column_updates. JSON-list columns ride as TEXT with default "[]" to
keep the SQLite/MySQL backend split honest, deserialised back to native
lists by the repo on read.

2026-05-02 18:07:57 -04:00

..

attackers

fix(ttp): resolve attacker_uuid from attacker_ip on bus-event consume

2026-05-02 02:44:30 -04:00

credentials

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

topology

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

__init__.py

feat(ttp): E.1.10 repository contract — TTPMixin with insert_tags + list_techniques_by_{identity,attacker,campaign,session} + list_distinct_techniques

2026-05-01 07:21:37 -04:00

_helpers.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

attacker_intel.py

feat(intel): persist per-provider taxonomy on AttackerIntel for TTP dispatch

2026-05-02 18:07:57 -04:00

auth.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

bounties.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

campaigns.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

canary.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

deckies.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

fleet.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

identities.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

logs.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

orchestrator.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

realism.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

swarm.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

tarpit.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

ttp.py

feat(ttp): show canonical ATT&CK technique names in the TTPs UI

2026-05-02 03:10:07 -04:00

webhooks.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00