Skip to content

feat(google-ti-feeds): skip attack_techniques API call when counter is 0 (#6562)#6667

Open
romain-filigran wants to merge 4 commits into
masterfrom
feat/6562
Open

feat(google-ti-feeds): skip attack_techniques API call when counter is 0 (#6562)#6667
romain-filigran wants to merge 4 commits into
masterfrom
feat/6562

Conversation

@romain-filigran

Copy link
Copy Markdown
Member

Proposed changes

  • Add a guard condition in orchestrators to avoid fetching attack_techniques relationships when the entity's counters.attack_techniques field is explicitly 0. This optimization reduces unnecessary API calls, primarily for vulnerabilities (~3000+ calls/day saved)
  • Add _filter_subentity_types() helper to BaseOrchestrator
  • Pass entity to filter before calling fetch_subentities in all orchestrators

Related issues

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key.
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

…s 0 (#6562)

Add a guard condition in orchestrators to avoid fetching attack_techniques
relationships when the entity's counters.attack_techniques field is
explicitly 0. This optimization reduces unnecessary API calls, primarily
for vulnerabilities (~3000+ calls/day saved).

- Add _filter_subentity_types() helper to BaseOrchestrator
- Pass entity to filter before calling fetch_subentities in all orchestrators
@codecov

codecov Bot commented Jun 8, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
...ctor/src/custom/orchestrators/base_orchestrator.py 83.33% 1 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (17e5df1) and HEAD (4e429ca). Click for more details.

HEAD has 110 uploads less than BASE
Flag BASE (17e5df1) HEAD (4e429ca)
connectors 112 2
Additional details and impacted files
@@             Coverage Diff             @@
##           master    #6667       +/-   ##
===========================================
- Coverage   29.77%    6.92%   -22.85%     
===========================================
  Files        1933     1885       -48     
  Lines      120805   119840      -965     
===========================================
- Hits        35964     8298    -27666     
- Misses      84841   111542    +26701     
Files with missing lines Coverage Δ
...om/orchestrators/campaign/orchestrator_campaign.py 94.28% <ø> (ø)
...stom/orchestrators/malware/orchestrator_malware.py 94.20% <ø> (ø)
...custom/orchestrators/report/orchestrator_report.py 93.40% <ø> (ø)
.../software_toolkit/orchestrator_software_toolkit.py 100.00% <ø> (ø)
...strators/threat_actor/orchestrator_threat_actor.py 94.28% <ø> (ø)
...rators/vulnerability/orchestrator_vulnerability.py 94.28% <ø> (ø)
...ctor/src/custom/orchestrators/base_orchestrator.py 97.43% <83.33%> (-2.57%) ⬇️

... and 830 files with indirect coverage changes

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Filigran-Automation Filigran-Automation added the filigran team Item from the Filigran team. label Jun 8, 2026
@romain-filigran romain-filigran marked this pull request as ready for review June 9, 2026 07:30
@ncarenton ncarenton requested a review from jabesq June 9, 2026 07:38
Copilot AI review requested due to automatic review settings June 11, 2026 12:14

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR optimizes the google-ti-feeds connector’s relationship resolution by using GTI entities’ attributes.counters to avoid unnecessary relationship fetches (notably attack_techniques) when the counter is explicitly 0, reducing avoidable API calls as described in issue #6562.

Changes:

  • Added BaseOrchestrator._filter_subentity_types() to drop subentity types whose corresponding counter is 0.
  • Updated orchestrators to pass the current entity into the filter before calling fetch_subentities.
  • Updated GTI debug response fixtures (formatting + counter values) used by the test harness.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
external-import/google-ti-feeds/connector/src/custom/orchestrators/base_orchestrator.py Adds counters-based filtering helper for subentity fetch types.
external-import/google-ti-feeds/connector/src/custom/orchestrators/vulnerability/orchestrator_vulnerability.py Applies filtering before fetching vulnerability relationships.
external-import/google-ti-feeds/connector/src/custom/orchestrators/threat_actor/orchestrator_threat_actor.py Applies filtering before fetching threat actor relationships.
external-import/google-ti-feeds/connector/src/custom/orchestrators/software_toolkit/orchestrator_software_toolkit.py Applies filtering before fetching software toolkit relationships.
external-import/google-ti-feeds/connector/src/custom/orchestrators/report/orchestrator_report.py Applies filtering before fetching report relationships.
external-import/google-ti-feeds/connector/src/custom/orchestrators/malware/orchestrator_malware.py Applies filtering before fetching malware family relationships.
external-import/google-ti-feeds/connector/src/custom/orchestrators/campaign/orchestrator_campaign.py Applies filtering before fetching campaign relationships.
external-import/google-ti-feeds/tests/custom/debug_responses/main_vulnerabilities_1a6f110bd333906d.json Updates debug fixture payload (formatting and counters).
external-import/google-ti-feeds/tests/custom/debug_responses/main_reports_1db15afcd82769e5.json Updates debug fixture payload (formatting and counters).

Comment on lines +132 to +158
@staticmethod
def _filter_subentity_types(subentity_types: list[str], entity: Any) -> list[str]:
"""Filter subentity types based on the entity's counters.

When the entity exposes a ``counters`` object (via ``attributes.counters``),
subentity types whose counter is explicitly ``0`` are removed from the
list to avoid unnecessary API calls.

See: https://github.com/OpenCTI-Platform/connectors/issues/6562

Args:
subentity_types: The full list of subentity types to fetch.
entity: The GTI entity object (must have ``attributes.counters``).

Returns:
A filtered list of subentity types worth fetching.

"""
counters = getattr(getattr(entity, "attributes", None), "counters", None)
if counters is None:
return subentity_types

return [
subentity_type
for subentity_type in subentity_types
if getattr(counters, subentity_type, None) != 0
]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

filigran team Item from the Filigran team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

perf(google-ti): optimize attack_patterns fetching by checking counters before API call

5 participants