Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45d6308111
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| or parsed.query | ||
| ): | ||
| raise ModuleError("A supported ESET ETI report link is required.") | ||
| match = re.fullmatch("/reports/apt/([a-zA-Z0-9-]+)(?:/download)?", parsed.path) |
There was a problem hiding this comment.
When this module receives the portal links emitted by ESET MISP, this matcher rejects them before making a request: ESET documents the path as /reports/apt/download/{uuid}, while this pattern only accepts /reports/apt/{uuid}/download or /reports/apt/{uuid}. Consequently the module cannot process its primary advertised input; match the documented portal URL format instead.
Useful? React with 👍 / 👎.
| try: | ||
| with requests.get( | ||
| download, | ||
| headers={"Authorization": "Bearer " + config["api_key"] + "|" + config["api_secret"]}, |
There was a problem hiding this comment.
When an operator configures credentials generated by the current ETI Access Credentials screen, they receive one REST API Token (and its ready-to-use Bearer header), not a separate key/secret pair. Requiring two values and synthesizing Bearer <api_key>|<api_secret> changes that token, so authenticated downloads will be rejected. Accept the single token and place it unchanged after Bearer, as described by ESET's credential documentation.
Useful? React with 👍 / 👎.
Supported ESET APT report links resolve to the documented fixed ETI PDF API endpoint. The module authenticates with the complete generated api_token, streams the PDF with a size cap, rejects redirects and non-PDF responses, and returns a standard MISP report object linked to the source attribute.
The report contains a title identifying the ESET report UUID, type=Report, deduplicated source and download links, and the PDF in report-file. The attachment comment records the PDF SHA-256. This uses existing report template relations and requires no object-template changes.
Includes a usage guide and focused adapter tests. Previous review fixes for portal-link ordering and token handling are preserved.
Validation: 21 module tests passed, including report-template relations, attachment bytes, SHA-256, source preservation and link deduplication; module flake8 passed. One existing package deprecation warning remains. Authenticated provider API validation remains pending.