fix(urlscan): honor config labels and duration_period (#6555)

[jabesq]

Proposed changes

• Fixed CONNECTOR_LABELS (now URLSCAN_LABELS) being silently ignored: the connector previously hardcoded default_labels=["Phishing", "phishfeed"] in connector.py instead of reading the value from configuration. Labels are now sourced from self._config.urlscan.labels.
• Deprecated connector.interval / CONNECTOR_INTERVAL in favor of connector.duration_period / CONNECTOR_DURATION_PERIOD, aligning this connector with the standard scheduling pattern used across other connectors, and replaced the raw-seconds interval with a proper timedelta.
• Added a DeprecatedField for interval so existing deployments that still set CONNECTOR_INTERVAL (in seconds) keep working: the old integer value is automatically converted into a duration_period timedelta under the hood.
• Added a default connector.id value so the connector can run out-of-the-box without requiring every deployment to generate its own UUID.
• Regenerated __metadata__/CONNECTOR_CONFIG_DOC.md and connector_config_schema.json to reflect the new CONNECTOR_DURATION_PERIOD and URLSCAN_LABELS variables and the deprecation of CONNECTOR_INTERVAL.
• Updated docker-compose.yml and src/config.yml.sample to use duration_period/labels and commented out optional variables to match current sample conventions.
• Simplified README.md to link to the auto-generated CONNECTOR_CONFIG_DOC.md instead of maintaining a manual, now-outdated configuration table.

Related issues

• Fixes fix(urlscan): ignores some user configs #6555

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

The connector.interval field is kept in the settings model but marked with DeprecatedField(deprecated="Use duration_period instead", new_namespaced_var="duration_period", new_value_factory=lambda x: timedelta(seconds=x)). This means: if an operator still sets CONNECTOR_INTERVAL (in seconds, as before), it is transparently converted into a timedelta and assigned to connector.duration_period, so no breaking change occurs for existing deployments. New deployments should set CONNECTOR_DURATION_PERIOD (ISO-8601 duration, e.g. P1D) directly. The connector still manages its own scheduling loop internally (it does not delegate to the SDK's built-in scheduler), it now just reads the interval from duration_period.total_seconds() instead of a raw interval int.

[github-actions]

🔴 Connector Linter errors detected

• VC308: No main.py found in src/ (external-import/urlscan:1)
• VC309: Relative import: from .client import UrlscanClient (external-import/urlscan/src/urlscan/connector.py:16)
• VC309: Relative import: from .loop import ConnectorLoop (external-import/urlscan/src/urlscan/connector.py:17)
• VC309: Relative import: from .patterns import IndicatorPattern, create_indicator_pattern_domain_name, create_indicator_pattern_url (external-import/urlscan/src/urlscan/connector.py:18)
• VC309: Relative import: from .settings import ConnectorSettings (external-import/urlscan/src/urlscan/connector.py:23)
• VC309: Relative import: from .connector import UrlscanConnector (external-import/urlscan/src/urlscan/main.py:3)
• VC312: send_stix2_bundle missing cleanup_inconsistent_bundle=True (external-import/urlscan/src/urlscan/connector.py:140)
• VC314: Uses while True loop instead of scheduler (external-import/urlscan/src/urlscan/loop.py:58)
• VC325: No tests/ directory found (external-import/urlscan:1)
• VC402: Dockerfile uses entrypoint.sh at line 15 (external-import/urlscan/Dockerfile:15)
• VC506: uses deprecated update_existing_data (external-import/urlscan/src/urlscan/connector.py:50)

[Copilot]

Pull request overview

This PR updates the external-import/urlscan connector to correctly honor configurable labels and to align its scheduling configuration with the repository’s standard connector.duration_period pattern (while keeping backward compatibility via a deprecated connector.interval).

Changes:

• Read observable labels from configuration (urlscan.labels) instead of hardcoding defaults in connector.py.
• Deprecate connector.interval in favor of connector.duration_period (timedelta-based), with automatic migration from legacy seconds.
• Regenerate configuration documentation/schema and update sample deployment files/README accordingly.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
external-import/urlscan/src/urlscan/settings.py	Adds urlscan.labels, introduces deprecated connector.interval migration to duration_period, and sets a default connector id.
external-import/urlscan/src/urlscan/connector.py	Switches scheduling to duration_period and sources default labels from config.
external-import/urlscan/src/config.yml.sample	Updates sample YAML to use duration_period and labels and aligns with current sample-comment conventions.
external-import/urlscan/README.md	Simplifies config documentation by linking to the generated CONNECTOR_CONFIG_DOC.md.
external-import/urlscan/docker-compose.yml	Updates sample env vars to use CONNECTOR_DURATION_PERIOD and URLSCAN_LABELS.
external-import/urlscan/metadata/connector_config_schema.json	Regenerated schema reflecting CONNECTOR_DURATION_PERIOD, deprecated CONNECTOR_INTERVAL, and URLSCAN_LABELS.
external-import/urlscan/metadata/CONNECTOR_CONFIG_DOC.md	Regenerated config documentation including deprecation and the new labels variable.