feat(google-ti-feeds): add malware/threat actor filter (#7024)

[throuxel]

Proposed changes

• Add optional filters to ensure imported IOCs are associated to a malware or a threat actor.

Related issues

• Closes: feat(google-ti-feeds): add malware/threat actor association filters for Delta Sync indicator import #7024

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[github-actions]

🔴 Connector Linter errors detected

• VC101: OPENCTI_TOKEN has non-standard value: 'ChangeMe' (external-import/google-ti-feeds/docker-compose.yml:7)
• VC101: OPENCTI_TOKEN has non-standard value: 'ChangeMe' (external-import/google-ti-feeds/.env.sample:2)
• VC102: OPENCTI_URL='http://localhost:PORT' — expected http://localhost (external-import/google-ti-feeds/.env.sample:1)
• VC301: No author identity definition found in connector source (external-import/google-ti-feeds:1)
• VC302: No author defined — cannot reference author on entities (external-import/google-ti-feeds:1)
• VC303: No CONNECTOR_TYPE definition found in application code (external-import/google-ti-feeds:1)
• VC305: No settings implementation found in connector source (external-import/google-ti-feeds:1)
• VC308: Main entry point issues in src/main.py: missing import traceback; missing if __name__ == "__main__": guard (external-import/google-ti-feeds/src/main.py:1)
• VC314: No schedule_process or schedule_iso call found (external-import/google-ti-feeds:1)
• VC315: No initiate_work call found (external-import/google-ti-feeds:1)
• VC316: No to_processed call found — work is never closed (external-import/google-ti-feeds:1)

[Copilot]

Pull request overview

Adds two optional association-based filters to the google-ti-feeds connector’s Delta Sync indicator ingestion so teams can restrict imported IOCs to those linked to a Malware Family and/or a Threat Actor, as requested in #7024.

Changes:

• Introduces two new boolean settings (GTI_INDICATOR_REQUIRE_MALWARE_FAMILY, GTI_INDICATOR_REQUIRE_THREAT_ACTOR) with OR logic between them and AND logic with the existing minimum-score filter.
• Implements association filtering in the IOC delta entry conversion path.
• Updates documentation, samples, generated config schema/docs, and adds/extends tests to cover the new filter behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
external-import/google-ti-feeds/connector/src/custom/convert_to_stix/indicator/convert_to_stix_indicator.py	Adds association-based filtering logic and skip behavior during IOC conversion.
external-import/google-ti-feeds/connector/src/custom/configs/indicator/gti_config_indicator.py	Adds two new boolean config fields with documented combination logic.
external-import/google-ti-feeds/tests/custom/convert_to_stix/indicator/test_convert_to_stix_indicator.py	Adds unit tests validating association-filter combinations and interaction with min-score filtering.
external-import/google-ti-feeds/tests/custom/orchestrators/indicator/test_orchestrator_indicator.py	Extends dummy config to include the new indicator filter flags.
external-import/google-ti-feeds/README.md	Documents the new configuration options in the connector README.
external-import/google-ti-feeds/.env.sample	Adds example env vars for the new options.
external-import/google-ti-feeds/config.yml.sample	Adds example YAML config keys for the new options (and min score example line).
external-import/google-ti-feeds/metadata/connector_config_schema.json	Updates generated schema to include the two new boolean settings.
external-import/google-ti-feeds/metadata/CONNECTOR_CONFIG_DOC.md	Updates generated config documentation to include the two new settings.

[jabesq]

LTGM 👍

[jabesq]

suggestion: Purely personal, but I prefer this representation of boolean using De Morgan's Law:

return not has_malware and not has_threat_actor

[jabesq]

suggestion: Maybe it could be easier to read if this method is checking the lack of association but the opposite, the presence of association:

def _has_required_association(self, entry: IOCDeltaEntry) -> bool:
        """Check whether an IOC entry has the required malware/threat actor associations.

        The filter is disabled when both indicator_require_malware_family and
        indicator_require_threat_actor are False (default), in which case this
        always returns True. When one or both are enabled, the indicator must
        have at least one matching association (OR logic between the two).
        """
        require_malware = self.config.indicator_require_malware_family
        require_threat_actor = self.config.indicator_require_threat_actor

        if not require_malware and not require_threat_actor:
            return True

        rels = entry.relationships

        has_malware = (
            rels is not None
            and rels.malware_families is not None
            and len(rels.malware_families.data) > 0
        )
        has_threat_actor = (
            rels is not None
            and rels.threat_actors is not None
            and len(rels.threat_actors.data) > 0
        )

        if require_malware and not require_threat_actor:
            return has_malware
        if require_threat_actor and not require_malware:
            return has_threat_actor
        # Both required: OR logic — at least one must be present
        return has_malware or has_threat_actor

...

 if not self._has_required_association(entry):
...