Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 176b25bcfb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for tag in _records(container, key): | ||
| tag = tag.get("Tag", tag) | ||
| if isinstance(tag, dict) and isinstance(tag.get("name"), str): | ||
| tag["name"].encode("utf-8") | ||
| if tag["name"]: | ||
| names.add(tag["name"]) |
There was a problem hiding this comment.
When an EventTag or AttributeTag record has local=true, this code unwraps the nested Tag and adds its name without checking the association flag, after which the name is sent to Azure as a STIX label or TLP marking. MISP defines local tags as instance-only and states that they are never exported or synchronized (MISP User Guide), so publishing a tagged event can disclose private routing or classification labels; filter local tag associations before aggregating names.
Useful? React with 👍 / 👎.
Existing
export_sentinelworkflows require a local MISP2Sentinel/MISP2Defender installation and provide only a boolean result. This adds native Microsoft Sentinel publishing through the current STIX objects upload API, available asmode=directinexport_sentineland as a dedicated blockingsentinel_publishaction. Existing wrapper mode remains the default.The direct publisher converts supplied IDS-marked event and object attributes into STIX 2.1 indicators, authenticates with server-side Entra client credentials, and sends batches of up to 100 objects to an explicit workspace. It supports credential-free dry runs, confidence and expiry, deterministic source-revision identities, source references and TLP markings. HTTP 200 indexed validation errors are mapped back to individual indicators; uncertain batch outcomes halt later uploads without automatic retries. Requests verify TLS, reject redirects and use fixed commercial-cloud endpoints.
Wrapper failures now surface a top-level workflow error, empty wrapper parameters apply the existing defaults, and script output is no longer copied into service logs. Both actions reject filtered/extracted payloads because the previous wrapper advertised filter support without applying it. The usage guide documents setup, supported inputs, partial publication, API limits and lifecycle semantics: updated source revisions receive new IDs, and older revisions are not automatically revoked. Existing MISP objects suffice; no object-template changes are needed.
Validation:
git diff --checkpassed for the changed code.No live Azure workspace was used. The target API is
2024-02-01-preview; deployment still requires valid Entra credentials, workspace permissions and preview API availability.