connectors
connectors copied to clipboard
feat: integrate relation extraction
Proposed changes
- Updated webservice call to use
/extract_entities_relationsendpoint withwith_relations=trueparam. - Extended parsing logic to handle
relationshipsfrom ML model response. - Tracked text-to-STIX ID mapping for relationship linking.
- Added support for Identity types (Sector, Organization, Individual) and custom object Channel.
- Created STIX relationships dynamically from predicted data when valid source/target IDs are found.
- Preserved original fallback logic for known relationship rules (simplified the code).
TODO:
- [ ] for perf, maybe avoid creating duplicate Relationship objects (rel_type, src_id, dst_id), so to have fewer instantiated Python objects, and if we need for later (text highlights) keep every textual mention by enriching the bundle with Note/Observed-Data ..
Related issues
- #3986
There is a typing issue related to self.file being implicitly defined as None in the __init__. We should initialize it there with self.file: dict[str, Any] | None = None
During my review and tests, I encountered several configuration issues (entirely due to my own setup...), and unfortunately the container did not log any errors to stdout, only a generic "Terminated" message. I’d like to suggest, at least, updating main.py to display the full traceback upon failure, similar to the approach used in other connectors within the codebase
main.py:
# -*- coding: utf-8 -*-
"""OpenCTI ReportImporter connector main module."""
from reportimporter import ReportImporter
if __name__ == "__main__":
import traceback
try:
connector = ReportImporter()
connector.start()
except Exception:
traceback.print_exc()
exit(1)