31 lines
1.1 KiB
Python
31 lines
1.1 KiB
Python
"""Intel lifter — opportunistic third-party verdict translator.
|
|
|
|
Contract step E.1.6 of ``development/TTP_TAGGING.md``. Empty body.
|
|
Implementation phase reads ``AttackerIntel`` rows and translates
|
|
provider verdicts (AbuseIPDB categories, GreyNoise classification,
|
|
Feodo / ThreatFox membership) into ATT&CK technique tags with
|
|
confidence scaled by per-provider reliability.
|
|
|
|
The decoupling rule (design doc §"Decoupling: bus-driven, never a
|
|
hard dependency") is enforced statically by E.2.7: this module MUST
|
|
NOT import from ``decnet.intel.{abuseipdb,greynoise,feodo,threatfox}``.
|
|
Only ``decnet.web.db.models`` symbols are permitted.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from decnet.ttp.base import TaggerEvent, TolerantTagger
|
|
from decnet.web.db.models.ttp import TTPTag
|
|
|
|
|
|
class IntelLifter(TolerantTagger):
|
|
name = "intel"
|
|
#: ``intel`` events are bus-published when an ``AttackerIntel`` row
|
|
#: is upserted; the lifter treats absence as the steady state.
|
|
HANDLES = frozenset({"intel"})
|
|
|
|
async def _tag_impl(self, event: TaggerEvent) -> list[TTPTag]:
|
|
return []
|
|
|
|
|
|
__all__ = ["IntelLifter"]
|