Skip to content

Sk csp break class attr - #45609

Draft
shmuel44 wants to merge 4 commits into
masterfrom
sk_csp_break_class_attr
Draft

Sk csp break class attr#45609
shmuel44 wants to merge 4 commits into
masterfrom
sk_csp_break_class_attr

Conversation

@shmuel44

@shmuel44 shmuel44 commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

Description

Must have

  • Tests
  • Documentation

@shmuel44
test(csp): remove COURSE_OF_ACTION from ThreatIntel.ObjectsScore
a0a571b 
Deliberate breaking change for CIAC-17274 AI-adjudication testing. Removes a public class attribute, so any caller referencing ThreatIntel.ObjectsScore.COURSE_OF_ACTION raises AttributeError at runtime. Disposable test branch, MUST NOT be merged.
@shmuel44
ci: pin infra CI ref to sk-csp-validation for CSP validator testing
8547bbe
@content-bot

content-bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CommonServerPython dependency impact

Impacted content items were found and need manual verification.

  • Changed symbols: 1
  • Public entrypoints: 1
  • Affected files: 12
  • Affected packs: 11

Affected files per pack are summarized below. The HTML checklist artifact lists every file.

  • Unit42ThreatIntelligencebyPaloAltoNetworks - 2 files
  • ApiModules - 1 file
  • AutoFocus - 1 file
  • Base - 1 file
  • DeCYFIR - 1 file
  • FeedFeedly - 1 file
  • FeedMitreAttackv2 - 1 file
  • FeedTAXII - 1 file
  • MandiantAdvantageThreatIntelligence - 1 file
  • SecneurXThreatFeeds - 1 file
  • Unit42Intel - 1 file

Open the HTML impact checklist

To accept this change without verifying each item, apply one of these PR labels: I'm okay with it, not-relevant-for-csp-validation.

Analyzed commit 4301b364 · generated 2026-08-23T20:34:33Z · CI job

@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

🤖 AI-Powered Code Review Available

You can leverage AI-powered code review to assist with this PR!

Available Commands:

  • @marketplace-ai-reviewer start review - Initiate a full AI code review
  • @marketplace-ai-reviewer re-review - Incremental review for new commits

@github-actions

github-actions Bot commented Aug 23, 2026

Copy link
Copy Markdown

⚠️ CommonServerPython change detected

This PR modifies one of the runtime-injected helper scripts (CommonServerPython.py / CommonServerPowerShell.ps1 / CommonServer.js).
A change here can impact every integration and script in the repository, so the standard PR pipeline is not enough.

Required before merge:

  1. Trigger the content nightly pipeline against this branch.
  2. Make sure the nightly run is green (all jobs passed).
  3. Add the nightly-run-passed label to this PR so this check turns green.

If you believe nightly is not required for this change, please justify it in a PR comment and add the label to unblock the check.

@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

CommonServerPython dependency impact

The AI adjudication stage confirmed 5 breaking files.

Adjudicated: 5 breaking, 0 warning, 7 safe.

Impacted content items were found and need manual verification.

  • Changed symbols: 1
  • Public entrypoints: 1
  • Affected files: 12
  • Affected packs: 11

The AI adjudication stage flagged these files as breaking:

File Confidence Why
Packs/Base/Scripts/StixParser/StixParser.py high Line 525 references ThreatIntel.ObjectsScore.COURSE_OF_ACTION when building the course_of_action indicator dict. The unified diff removes COURSE_OF_ACTION = 0 f...
Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py high Line 1756 references ThreatIntel.ObjectsScore.COURSE_OF_ACTION inside the course_of_action indicator dict built by parse_course_of_action. Because the CSP diff...
Packs/FeedFeedly/Integrations/FeedFeedly/FeedFeedly.py high Line 496 accesses ThreatIntel.ObjectsScore.COURSE_OF_ACTION when building the course_of_action indicator. The CSP change removes that class attribute, so the pa...
Packs/DeCYFIR/Integrations/decyfiriocs/decyfiriocs.py high The module-level THREAT_INTEL_SCORES dict (around line 54) maps ThreatIntel.ObjectsNames.COURSE_OF_ACTION to ThreatIntel.ObjectsScore.COURSE_OF_ACTION. Because...
Packs/FeedMitreAttackv2/Integrations/FeedMitreAttackv2/FeedMitreAttackv2.py high The module-level INDICATOR_TYPE_TO_SCORE dict at line 24 contains "Course of Action": ThreatIntel.ObjectsScore.COURSE_OF_ACTION. The CSP diff removes that att...

Affected files per pack are summarized below. The HTML checklist artifact lists every file.

  • Unit42ThreatIntelligencebyPaloAltoNetworks - 2 files
  • ApiModules - 1 file
  • AutoFocus - 1 file
  • Base - 1 file
  • DeCYFIR - 1 file
  • FeedFeedly - 1 file
  • FeedMitreAttackv2 - 1 file
  • FeedTAXII - 1 file
  • MandiantAdvantageThreatIntelligence - 1 file
  • SecneurXThreatFeeds - 1 file
  • Unit42Intel - 1 file

Open the HTML impact checklist

To accept this change without verifying each item, apply one of these PR labels: I'm okay with it, not-relevant-for-csp-validation.

Analyzed commit f7dfc80b · generated 2026-08-23T10:50:22Z · CI job

@github-actions

github-actions Bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Coverage

Tests Skipped Failures Errors Time
7287 269 💤 0 ❌ 0 🔥 5m 39s ⏱️

@content-bot

This comment has been minimized.

Sign in to view
@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

CommonServerPython dependency impact

The AI adjudication stage confirmed 5 breaking files.

Adjudicated: 5 breaking, 0 warning, 7 safe.

Impacted content items were found and need manual verification.

  • Changed symbols: 1
  • Public entrypoints: 1
  • Affected files: 12
  • Affected packs: 11

The AI adjudication stage flagged these files as breaking:

File Confidence Why
Packs/Base/Scripts/StixParser/StixParser.py high The class attribute ThreatIntel.ObjectsScore.COURSE_OF_ACTION was removed. StixParser directly reads that attribute at line 525 inside parse_course_of_action (s...
Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py high The removed attribute ThreatIntel.ObjectsScore.COURSE_OF_ACTION is read at line 1756 inside the parse_course_of_action method (score field of the course_of_acti...
Packs/FeedFeedly/Integrations/FeedFeedly/FeedFeedly.py high ThreatIntel.ObjectsScore.COURSE_OF_ACTION is dereferenced at line 496 inside parse_course_of_action (score field of the course_of_action dict). After the remova...
Packs/DeCYFIR/Integrations/decyfiriocs/decyfiriocs.py high The module-level dict THREAT_INTEL_SCORES (lines 50-57) evaluates ThreatIntel.ObjectsScore.COURSE_OF_ACTION at import time. With the attribute removed the integ...
Packs/FeedMitreAttackv2/Integrations/FeedMitreAttackv2/FeedMitreAttackv2.py high The module-level dict INDICATOR_TYPE_TO_SCORE (lines 22-28) contains "Course of Action": ThreatIntel.ObjectsScore.COURSE_OF_ACTION, which is evaluated at import...

Affected files per pack are summarized below. The HTML checklist artifact lists every file.

  • Unit42ThreatIntelligencebyPaloAltoNetworks - 2 files
  • ApiModules - 1 file
  • AutoFocus - 1 file
  • Base - 1 file
  • DeCYFIR - 1 file
  • FeedFeedly - 1 file
  • FeedMitreAttackv2 - 1 file
  • FeedTAXII - 1 file
  • MandiantAdvantageThreatIntelligence - 1 file
  • SecneurXThreatFeeds - 1 file
  • Unit42Intel - 1 file

Open the HTML impact checklist

To accept this change without verifying each item, apply one of these PR labels: I'm okay with it, not-relevant-for-csp-validation.

Analyzed commit 6b87d6cc · generated 2026-08-23T16:49:04Z · CI job

@content-bot

This comment has been minimized.

Sign in to view
@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

⚠️ The PR is missing the ready-for-pipeline-running label. Please add the label when the PR is ready in order to proceed.

@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

CommonServerPython dependency impact

The AI adjudication stage confirmed 5 breaking files.

Adjudicated: 5 breaking, 0 warning, 7 safe.

Impacted content items were found and need manual verification.

  • Changed symbols: 1
  • Public entrypoints: 1
  • Affected files: 12
  • Affected packs: 11

The AI adjudication stage flagged these files as breaking:

File Confidence Why
Packs/Base/Scripts/StixParser/StixParser.py high Line 525 constructs the course_of_action dict with "score": ThreatIntel.ObjectsScore.COURSE_OF_ACTION. The diff removes the COURSE_OF_ACTION = 0 member from...
Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py high Line 1756 sets "score": ThreatIntel.ObjectsScore.COURSE_OF_ACTION inside parse_course_of_action. The diff removed COURSE_OF_ACTION from `ThreatIntel.Objec...
Packs/FeedFeedly/Integrations/FeedFeedly/FeedFeedly.py high Line 496 in parse_course_of_action sets "score": ThreatIntel.ObjectsScore.COURSE_OF_ACTION. The diff removes that member from the class, so the attribute ac...
Packs/DeCYFIR/Integrations/decyfiriocs/decyfiriocs.py high Line 53 defines a module-level constant THREAT_INTEL_SCORES whose value includes `ThreatIntel.ObjectsNames.COURSE_OF_ACTION: ThreatIntel.ObjectsScore.COURSE_O...
Packs/FeedMitreAttackv2/Integrations/FeedMitreAttackv2/FeedMitreAttackv2.py high Line 24 defines the module-level dict INDICATOR_TYPE_TO_SCORE containing "Course of Action": ThreatIntel.ObjectsScore.COURSE_OF_ACTION. This dict is evaluat...

Affected files per pack are summarized below. The HTML checklist artifact lists every file.

  • Unit42ThreatIntelligencebyPaloAltoNetworks - 2 files
  • ApiModules - 1 file
  • AutoFocus - 1 file
  • Base - 1 file
  • DeCYFIR - 1 file
  • FeedFeedly - 1 file
  • FeedMitreAttackv2 - 1 file
  • FeedTAXII - 1 file
  • MandiantAdvantageThreatIntelligence - 1 file
  • SecneurXThreatFeeds - 1 file
  • Unit42Intel - 1 file

Open the HTML impact checklist

To accept this change without verifying each item, apply one of these PR labels: I'm okay with it, not-relevant-for-csp-validation.

Analyzed commit 4301b364 · generated 2026-08-23T20:34:33Z · CI job

@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

Validate summary
The following errors were thrown as a part of this pr: PA114, RN106.
The following errors cannot be ignored: PA114, RN106.
The following errors don't run as part of the nightly flow and therefore can be force merged: PA114, RN106.
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.

Verdict: PR can be force merged from validate perspective? ✅

@content-bot

content-bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

🔍 AI Triage Report Available

An automated triage report has been generated for this pipeline.

Status: failed
Report ID: 107077f287001119

📋 Triage Report
💡 Resolutions are available in the full report.

⚠️ AI-generated triage. Validate before acting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@shmuel44 @content-bot