Claude/add claude documentation k8vv j

[wrhalpin]

No description provided.

[Copilot]

Pull request overview

This PR expands investigation/case support across several platform connectors by introducing observed-data routing (to incident/event resources), adding investigation-linking helper APIs, and adding a large set of extended unit tests for workspace/global-context behavior.

Changes:

• Add extended unit tests covering additional workspace/global-context code paths (commit/delete flows, enrichment history, async enrichment fallbacks, SQLite workspace store behaviors).
• Extend XSOAR, ThreatQ, and GreyMatter connectors to map observed-data to incident/event endpoints and document investigation-linking usage.
• Add/adjust STIX translation helpers and type mappings to support the new investigation paths.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
tests/unit/context/test_workspace_extended.py	New extended unit tests for workspace/global-context behaviors and SQLite store paths.
gnat/connectors/xsoar/client.py	Adds observed-data → incident CRUD support, richer STIX translation, and incident-linking helper.
gnat/connectors/threatq/client.py	Adds observed-data → event mapping, event-linking helper, and updated listing behavior/docs.
gnat/connectors/greymatter/client.py	Adds observed-data → incidents mapping and incident-to-STIX translation/docs.

Comments suppressed due to low confidence (1)

gnat/connectors/greymatter/client.py:300

• stix_type_map and CRUD methods now advertise support for stix_type="observed-data" (incidents), but from_stix() still always translates into an observable payload. Since GlobalContext.write_object() relies on from_stix() before calling upsert_object(stix_dict["type"], payload), writing an observed-data object will POST incident endpoints with the wrong fields. Add an observed-data branch in from_stix() that produces the GreyMatter incident/case schema (e.g. title, description, severity, status, etc.).

    def from_stix(self, stix_dict: dict[str, Any]) -> dict[str, Any]:
        """
        Translate a STIX Indicator dict to a GreyMatter observable payload.
        """
        pattern = stix_dict.get("pattern", "")
        gm_type = self._infer_gm_type(pattern)
        value   = self._extract_value(pattern)
        return {
            "type":        gm_type,
            "value":       value or stix_dict.get("name", ""),
            "description": stix_dict.get("description", ""),
            "confidence":  stix_dict.get("confidence", 50),
            "tlp":         stix_dict.get("x_tlp", "white"),
            "tags":        stix_dict.get("x_gm_tags", []),
        }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

upsert_object() calls link_event(event_id, payload) after writing. At this point payload is a ThreatQ-native request body (e.g. {"value": ..., "type": ...}) and does not contain STIX name/pattern, so link_event() will post an empty value and infer the type from an empty pattern. Pass the original STIX dict into link_event(), or update link_event() to also accept native payloads (e.g. fall back to value/type when name/pattern are missing).

[Copilot]

The docstring/STIX type map indicate observed-data is supported (mapped to ThreatQ Events), but from_stix() always builds an indicator payload (value/type/status). Since GlobalContext.write_object() uses client.from_stix(stix_dict) for all types, writes of STIX observed-data will send the wrong schema to the /api/events endpoint. Add a type == "observed-data" branch in from_stix() to generate an event payload (e.g. title, description, happened_at, event_type, etc.) compatible with ThreatQ events.

[Copilot]

_indicator_to_stix() uses a fallback object-path of "unknown:value" when the XSOAR indicator_type isn’t in _XSOAR_TYPE_TO_STIX. unknown isn’t a valid STIX object type, so this produces an invalid STIX pattern like [unknown:value = '...']. Consider falling back to an empty pattern (and leaving the type unclassified), or mapping unknowns to a valid generic observable type; also ensure the value is escaped so quotes in the indicator value can’t break the pattern syntax.

Suggested change

	def _indicator_to_stix(self, native: dict[str, Any]) -> dict[str, Any]:
	"""Map an XSOAR indicator dict to a STIX Indicator SDO."""
	xsoar_type = str(native.get("indicator_type", "")).lower()
	stix_path = _XSOAR_TYPE_TO_STIX.get(xsoar_type, "unknown:value")
	value = native.get("value", "")
	pattern = f"[{stix_path} = '{value}']" if value else ""
	@staticmethod
	def _escape_stix_pattern_value(value: Any) -> str:
	"""Escape a value for safe inclusion in a STIX pattern string literal."""
	return str(value).replace("\\", "\\\\").replace("'", "\\'")
	def _indicator_to_stix(self, native: dict[str, Any]) -> dict[str, Any]:
	"""Map an XSOAR indicator dict to a STIX Indicator SDO."""
	xsoar_type = str(native.get("indicator_type", "")).lower()
	stix_path = _XSOAR_TYPE_TO_STIX.get(xsoar_type)
	value = native.get("value", "")
	escaped_value = self._escape_stix_pattern_value(value)
	pattern = f"[{stix_path} = '{escaped_value}']" if stix_path and value else ""