fix: send_stix_bundle() and register() do not check for GraphQL-level errors

[CTIBurn0ut]

Summary

send_stix_bundle() and register() in app_connector_helper.py only check for HTTP-level failures (r.status_code != 200). They do not inspect the response body for GraphQL-level errors.

OpenCTI's GraphQL API can return HTTP 200 with an "errors" key in the JSON body (e.g. permission denied, invalid bundle, schema validation failure). When this happens, the alert action treats it as a success — the STIX bundle is silently rejected.

Affected File

TA-opencti-add-on/bin/ta_opencti_add_on/app_connector_helper.py

Current Behavior

r = requests.post(
    url=self.api_url,
    json={"query": query, "variables": variables},
    headers=self.headers,
    verify=VERIFY_SSL,
    proxies=self.proxies
)
if r.status_code != 200:
    raise Exception(...)
# ← No check for {"errors": [...]} in r.json()

Expected Behavior

After confirming status_code == 200, the response body should be parsed and checked:

data = r.json()
if "errors" in data:
    raise Exception(f"OpenCTI GraphQL errors: {data['errors']}")

Impact

This is a silent failure path. Alert actions report success to Splunk while OpenCTI rejects the bundle. The user sees "completed successfully" in Splunk but no objects appear in OpenCTI. This was observed in a customer escalation (ref: OCTI1-3113).

Note

The newer splunk-enterprise-add-on repo has a graphql_query() method that correctly checks for GraphQL errors, but send_stix_bundle() and register() in that repo still bypass it by calling requests.post directly. A parallel issue has been filed there.