Repository navigation
feat: [criminal_ip] add IP and domain report enrichment - #1060
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db918780b4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| _annotation(event, attribute, "Domain scan submitted", receipt) | ||
| return | ||
| if rows: | ||
| scan_id = str(rows[0]["scan_id"]) |
There was a problem hiding this comment.
When this keyword query returns multiple reports, selecting rows[0] without checking its url can attach a scan for a different URL or hostname to the source attribute. Criminal IP documents Domain Search as a keyword/filter search, and /v1/domain/reports can return up to 100 results, so common or suffix-overlapping names can produce non-exact matches. Filter the rows by the normalized hostname/domain and select an appropriate exact match before fetching its scan ID.
Useful? React with 👍 / 👎.
| if kind in ("ip-src", "ip-dst"): | ||
| if ipaddress.ip_address(value).version != 4: | ||
| raise ModuleError("Criminal IP IP reports require IPv4.") | ||
| data = _response("GET", "/v1/asset/ip/report", config, params={"ip": value}) |
There was a problem hiding this comment.
For the default max_results=25, and for every configured value from 21 through 100, this request cannot supply enough rows: Criminal IP's IP report documentation states that omitting full=true returns at most 20 data items. Consequently, the later slice can never honor these supported limits and the retained provider JSON is also truncated; request full data before applying the local limit, or cap and document the option at 20.
Useful? React with 👍 / 👎.
Analysts can retrieve Criminal IP IPv4 reports and the latest available domain report, or retrieve a report by numeric scan ID. An explicit submit_unknown setting permits a domain scan when no report exists. Submissions return a receipt without polling or automatic retries. Provider risk fields retain their original values.
Includes a usage guide and focused adapter tests.
Validation:
21 passed, 1 warning in 0.76swithpytest -q tests/test_criminal_ip.py; flake8 passed for the module. The combined enrichment regression check passed 389 tests.Authenticated provider API validation remains pending. Tests use sanitized fixtures; no provider credentials are included.
Review updates: Select only reports whose normalized hostname matches the requested domain, request full IP report rows before applying the local cap, and preserve IP direction.
Updated validation: 22 passed, 1 warning in 0.67s; module lint passed. Combined regression validation passed 409 tests.