feat(tenable-security-center): migrate connector to the catalog (#7560) - #7597
Open
Hugo Dupras (jabesq) wants to merge 8 commits into
Open
Hugo Dupras (jabesq) wants to merge 8 commits into
Hugo Dupras (jabesq) wants to merge 8 commits into
Conversation
|
🔴 Connector Linter errors detected
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the tenable-security-center external-import connector to the OpenCTI connector catalog as a manager-supported integration by replacing the legacy config loader stack with validated connectors-sdk / Pydantic settings, and by generating the associated catalog metadata (schema + config docs).
Changes:
- Introduces
ConnectorSettings(connectors-sdkBaseConnectorSettings) and wires it intoapp.py, keeping the existing runtime structure intact. - Removes the legacy env/YAML config loader system and its related error type, reducing dead/unreachable configuration paths.
- Adds config normalization (
config.yml.sample,.env.sample), generates__metadata__/connector_config_schema.json+CONNECTOR_CONFIG_DOC.md, and adds unit tests for settings + wiring.
Reviewed changes
Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| external-import/tenable-security-center/tenable_security_center/settings.py | Adds connectors-sdk/Pydantic settings model and TSC-specific config section. |
| external-import/tenable-security-center/app.py | Switches runtime wiring from legacy loader to ConnectorSettings + to_helper_config(). |
| external-import/tenable-security-center/tests/tests_connector/test_settings.py | Adds unit tests validating settings parsing/defaults and invalid-input handling. |
| external-import/tenable-security-center/tests/test_main.py | Adds wiring tests for ConnectorSettings → helper config and connector instantiation. |
| external-import/tenable-security-center/metadata/connector_manifest.json | Marks the connector as manager_supported: true. |
| external-import/tenable-security-center/metadata/connector_config_schema.json | Adds generated catalog JSON schema for configuration. |
| external-import/tenable-security-center/metadata/CONNECTOR_CONFIG_DOC.md | Adds generated configuration documentation table. |
| external-import/tenable-security-center/config.yml.sample | Adds SDK-compatible YAML sample filename/format. |
| external-import/tenable-security-center/.env.sample | Adds repo-convention env sample with required variables surfaced. |
| external-import/tenable-security-center/docker-compose.yml | Updates compose environment block to reflect required vs optional variables. |
| external-import/tenable-security-center/README.md | Replaces inline config variable listing with a pointer to generated config docs. |
| external-import/tenable-security-center/pyproject.toml | Adds connectors-sdk dependency and mypy overrides for connectors_sdk.*. |
| external-import/tenable-security-center/src/init.py | Re-exports ConnectorSettings for the config schema generator import path. |
| external-import/tenable-security-center/tenable_security_center/ports/errors.py | Removes now-orphaned legacy ConfigLoaderError. |
| external-import/tenable-security-center/.gitignore | Ignores local build/** artifacts. |
| external-import/tenable-security-center/tenable_security_center/ports/config.py | Removes legacy config port interfaces (unreachable after migration). |
| external-import/tenable-security-center/tenable_security_center/adapters/config/env.py | Removes legacy env-based config loader implementation. |
| external-import/tenable-security-center/tenable_security_center/adapters/config/config_yaml.py | Removes legacy YAML config loader implementation. |
| external-import/tenable-security-center/env.sample | Deletes legacy env sample (superseded by .env.sample). |
| external-import/tenable-security-center/config.yaml.sample | Deletes legacy YAML sample (renamed to config.yml.sample). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+18
to
+35
| import stix2 # type: ignore[import-untyped] # stix2 does not provide stubs | ||
| from connectors_sdk import ( | ||
| BaseConfigModel, | ||
| BaseConnectorSettings, | ||
| BaseExternalImportConnectorConfig, | ||
| DatetimeFromIsoString, | ||
| ListFromString, | ||
| ) | ||
| from pydantic import Field, SecretStr | ||
|
|
||
| _TLP_MARKINGS = { | ||
| # "TLP:CLEAR" and "TLP:WHITE" map to the same marking definition | ||
| "TLP:CLEAR": stix2.TLP_WHITE, | ||
| "TLP:WHITE": stix2.TLP_WHITE, | ||
| "TLP:GREEN": stix2.TLP_GREEN, | ||
| "TLP:AMBER": stix2.TLP_AMBER, | ||
| "TLP:RED": stix2.TLP_RED, | ||
| } |
Comment on lines
+131
to
+133
| assert settings.tsc.marking_definition == "TLP:CLEAR" | ||
| assert settings.tsc.tlp_marking.definition_type == "tlp" | ||
|
|
Thibaut Rouxel (throuxel)
approved these changes
Sep 10, 2026
…anager-supported mode (#7560) Bump pycti to 7.260907.0 to match the version pinned by connectors-sdk, which is required to resolve the connector dependencies.
…ode (#7560) Cover the new Pydantic settings (validation, defaults, unique connector id default) and their wiring into the existing connector entry point. Let mypy follow the untyped connectors-sdk imports so the strict type check of the settings module keeps passing.
…ers (#7560) The Pydantic settings introduced by the catalog migration replaced the hand-rolled configuration system, leaving ports/config.py and adapters/config/env.py unreachable from any entry point. adapters/config/ config_yaml.py was already dead before the migration, and ConfigLoaderError was only ever raised by those loaders. Removing them drops ~1000 lines and the last uses of the deprecated pycti.get_config_variable helper in this connector.
The editable install used for local validation writes a build/ directory inside the connector, which must not be tracked.
Hugo Dupras (jabesq)
force-pushed
the
feat/7560-tenable-security-center-catalog
branch
from
September 10, 2026 14:24
8b6adb2 to
32940ce
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
ConnectorSettingsmodel and is handed toOpenCTIConnectorHelperviato_helper_config().tenable_security_center/settings.pymirroring the previous configuration variables 1:1, withSecretStrfor the API keys,Literalenums for the severity and TLP options, andDatetimeFromIsoStringforTSC_EXPORT_SINCE.app.pyin place — the file layout, class names,schedule_isoscheduling and logging are deliberately unchanged.ports/config.py,adapters/config/env.py,adapters/config/config_yaml.pyand the orphanedConfigLoaderError), which dropped ~1000 lines and the connector's last uses of the deprecatedpycti.get_config_variablehelper.config.yaml.sample→config.yml.sample(required by the SDK settings loader) andenv.sample→.env.sample(repo convention); required variables are uncommented withChangeMe, defaulted ones are commented out.__metadata__/connector_config_schema.jsonandCONNECTOR_CONFIG_DOC.md, and setmanager_supported: truein the manifest.Related issues
Checklist
Further comments
This is the manager-supported pass only; the connector is intentionally not "verified" yet. Restructuring into a
connector/package, theconnector.py/main.pysplit, and STIX-ID determinism work are out of scope and left for a separate pass.Two points worth reviewing:
pyctiwas bumped7.260904.0→7.260907.0to match the pin inconnectors-sdk, without which the dependency set is unresolvable.severity_min_level,process_systems_without_vulnerabilities,marking_definition,duration_period) now carry their documented values as defaults. This is a small, deliberate relaxation that improves catalog UX — happy to revert if you would rather keep them strictly required.A
mypyoverride was added forconnectors_sdk.*because the SDK is fully typed but ships nopy.typedmarker, whichmypy --strictrejects. Adding that marker upstream would be the real fix.Validation: 68 tests pass,
black/isort/flake8clean,ruffandmypy --strictclean (enforced by this connector's ownconftest.py), andgenerate_config_schemais reproducible with no diff.