Summary
VERIFY_SSL is hardcoded to True in constants.py. There is no way for users to disable SSL certificate verification through the add-on's configuration UI.
Environments with self-signed certificates, internal CAs, or proxy-based TLS inspection cannot use the alert actions without modifying the source code.
Affected File
TA-opencti-add-on/bin/ta_opencti_add_on/constants.py
VERIFY_SSL = True # SSL verification by default
Expected Behavior
SSL verification should be configurable via the add-on's Configuration tab (globalConfig). The setting should:
- Default to
True (verify SSL) for security
- Allow users to set it to
False for environments with self-signed certs or TLS inspection proxies
- Be read at runtime via
helper.get_global_setting("verify_ssl") and passed to SplunkAppConnectorHelper
Impact
Users in enterprise environments with non-public CAs cannot use the add-on's alert actions without code modification. This is a common deployment pattern in air-gapped and government environments.
Summary
VERIFY_SSLis hardcoded toTrueinconstants.py. There is no way for users to disable SSL certificate verification through the add-on's configuration UI.Environments with self-signed certificates, internal CAs, or proxy-based TLS inspection cannot use the alert actions without modifying the source code.
Affected File
TA-opencti-add-on/bin/ta_opencti_add_on/constants.pyExpected Behavior
SSL verification should be configurable via the add-on's Configuration tab (globalConfig). The setting should:
True(verify SSL) for securityFalsefor environments with self-signed certs or TLS inspection proxieshelper.get_global_setting("verify_ssl")and passed toSplunkAppConnectorHelperImpact
Users in enterprise environments with non-public CAs cannot use the add-on's alert actions without code modification. This is a common deployment pattern in air-gapped and government environments.