feat(hatching triage sandbox): support enrichment of connector Hatching triage sandbox using SCO's (#7674)

[pedropaton-tech]

Proposed changes

*Add Stix files as an possibility to use this connector when enriching observables
*Added test to:

• Verify that when OpenCTI sends a StixFile, the connector routes it through the same observable-processing flow as an artifact instead of ignoring it.

• Checks that a file uploaded as a StixFile is fetched from OpenCTI storage, hashed, searched in Hatching Triage, and then passed to the report-processing logic.

• Covers the case where a StixFile only contains hashes and no file content. The connector should still look up an existing report using the hash and reuse it.

• Parametrized test verifying correct query generation for:

  1. SHA-256
  2. SHA-1
  3. MD5
  4. SHA-512

• Test that the connector doesn’t stop at the first hash; it tries each available hash until it finds a matching Hatching Triage analysis.

• Sample ID is returned when a matching analysis exists.

• No result returns none.

• Server errors are handled safely.

• The search is skipped when use_existing_analysis is disabled.

Related issues

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[filigran-cla-bot]

Contributor License Agreement

✅ CLA signed 💚

Thank you pedropaton-tech for signing the Contributor License Agreement! Your pull request can now be reviewed and merged.

We appreciate your contribution to Filigran's open source projects! ❤️

_{This is an automated message from the Filigran CLA Bot.}

[Copilot]

Pull request overview

Adds StixFile enrichment support to Hatching Triage Sandbox, including attached-file processing and hash-only analysis reuse.

Changes:

• Extends connector scopes, configuration, metadata, and documentation.
• Adds file retrieval, hashing, and existing-analysis lookup.
• Adds tests for routing, hash algorithms, reuse, and error handling.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal-enrichment/hatching-triage-sandbox/tests/tests_connector/test_settings.py	Updates scope-related test configuration.
internal-enrichment/hatching-triage-sandbox/tests/tests_connector/test_connector.py	Tests StixFile processing and hash-based reuse.
internal-enrichment/hatching-triage-sandbox/tests/test_main.py	Updates connector scope expectations.
internal-enrichment/hatching-triage-sandbox/src/connector/settings.py	Enables StixFile by default.
internal-enrichment/hatching-triage-sandbox/src/connector/connector.py	Implements StixFile routing and hash lookups.
internal-enrichment/hatching-triage-sandbox/src/config.yml.sample	Updates sample scope configuration.
internal-enrichment/hatching-triage-sandbox/README.md	Documents StixFile support and usage.
internal-enrichment/hatching-triage-sandbox/docker-compose.yml	Updates deployment scope configuration.
internal-enrichment/hatching-triage-sandbox/.env.sample	Updates sample environment scope.
internal-enrichment/hatching-triage-sandbox/__metadata__/connector_config_schema.json	Updates generated scope metadata.
internal-enrichment/hatching-triage-sandbox/__metadata__/CONNECTOR_CONFIG_DOC.md	Updates generated configuration documentation.

Suppressed comments (2)

internal-enrichment/hatching-triage-sandbox/README.md:32

• The connector catalog metadata remains stale: __metadata__/connector_manifest.json still describes this connector as submitting only Artifacts, so consumers of the manifest will not discover the new File SCO support even though the README was updated. Please update the manifest description together with this documentation change.

This internal enrichment connector submits files (Artifacts and File SCOs) and URLs to Hatching Triage for dynamic analysis and enriches OpenCTI with the analysis results including:

internal-enrichment/hatching-triage-sandbox/README.md:108

• The documented flow is not accurate for the new hash-only File SCO path: that path only searches existing analyses and raises when none is found, so it neither submits a sample nor waits for analysis. Qualify the submission/wait steps for observables with attached file content and document that hash-only SCOs require a reusable existing report.

The connector enriches Artifact, File SCO, and URL observables by:
1. Checking for existing analysis (if enabled)
2. Submitting the sample to Hatching Triage
3. Waiting for analysis completion
4. Processing and importing the results

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.