connectors icon indicating copy to clipboard operation
connectors copied to clipboard
verified publisher icon OpenCTI-Platform

Improve ImportExternalRef

Open alice-debra opened this issue 6 months ago • 1 comments

Observed with Intel471 RSS feed, ImportExtRef creates the same Content (file) for all different reports.

In some RSS feeds, the Import Document connector was not able to pull the content of the site. I think it is being detected as a scraper and the sites are blocking/preventing it. (To check)

Issue:

  • Missing images in all the import

  • Issues with pulling Intel471 feed reports - maybe hold on as the reports might come through Intel471

  • MS RSS feed doesn't works

  • Securelist RSS feed doesn't works

  • Security Affairs - importing the wrong article

  • Sekoia Article - IOC/TTPs not pulled apart

  • SOC Radar Doesn't work

  • And some of the reports with the ImportExternalReference are not able to pull in TTPs.

alice-debra avatar May 27 '25 07:05 alice-debra

Can we add FBI IC3 RSS feed? No description or PDF is being pulled in.

EinatAR avatar May 29 '25 16:05 EinatAR

Improvements added by this issue (https://github.com/OpenCTI-Platform/connectors/issues/4271) could solve some problems listed in this ticket. Problems listed will have to be reassessed once the PR (https://github.com/OpenCTI-Platform/connectors/pull/4186) has been merged.

romain-filigran avatar Jul 14 '25 17:07 romain-filigran