fix(scanmalware): map the malicious risk level, tag from threat_categories

Two mapping bugs found by running the analyzer against the live archive
rather than against fixtures.

RISK_LEVELS_MEANING_MALICIOUS was ("high", "critical"). Sampling the live
API gives low 74, malicious 14, high 9, medium 2, and no critical at all,
so a page the scanner calls outright Malicious at 95% confidence set no
evaluation, while the value being checked for is one the API has not been
observed to emit. The vocabulary had been taken from the SMQL `verdict`
filter enum (LOW_RISK/MODERATE_RISK/HIGH_RISK), which is a different field
from security_verdict.risk_level.

Tags were derived from risk_factors alone. A live verdict of "High Risk
(Credential Phishing on disposable hosting)" carrying
threat_categories: ["Credential Phishing"] was tagged with nothing, because
its only risk factor named the flagged IPs. threat_categories is the
structured field and is now read first, with the verdict string and the
risk factors kept as prose fallbacks.

Three tests added, each failing against the previous code.

Author: jonaslejon

api_app/analyzers_manager/observable_analyzers/scanmalware.py

@@ -60,7 +60,13 @@ def run(self):
     # model. The AI endpoint returns model prose ("The site shows a simple document
     # download page…"), which is useful to read and not something to convert into
     # an evaluation.
-    RISK_LEVELS_MEANING_MALICIOUS = ("high", "critical")
+    # `malicious` is the scanner's strongest level and is NOT a synonym for `high`:
+    # sampling the live archive on 2026-09-01 found low 74, malicious 14, high 9,
+    # medium 2, and no `critical` at all. Omitting it meant a scan the scanner calls
+    # outright Malicious at 95% confidence produced no evaluation, while the value
+    # actually being checked for was one the API never emits. `critical` is kept
+    # because it costs nothing and the API does not publish this enum.
+    RISK_LEVELS_MEANING_MALICIOUS = ("malicious", "critical", "high")
 
     def _do_create_data_model(self) -> bool:
         return super()._do_create_data_model() and bool(self.__security_verdict())
@@ -75,8 +81,8 @@ def _update_data_model(self, data_model) -> None:
         factors = verdict.get("risk_factors") or []
 
         # A low or medium risk level is not a statement that the site is safe, so
-        # it sets no evaluation. Only an explicit high risk is asserted, and even
-        # then the confidence the scanner reported travels with it.
+        # it sets no evaluation. Only an explicit high-or-worse level is asserted,
+        # and even then the confidence the scanner reported travels with it.
         if risk_level in self.RISK_LEVELS_MEANING_MALICIOUS:
             data_model.evaluation = self.EVALUATIONS.MALICIOUS.value
             confidence = verdict.get("confidence")
@@ -86,13 +92,24 @@ def _update_data_model(self, data_model) -> None:
                 # be banker's rounding: 85 and 75 both land on 8 while 86 goes to 9.
                 data_model.reliability = int(max(0, min(10, confidence // 10)))
 
-        # Keyword matching over the scanner's own risk factors. "credential" earns
-        # its place: "Credential form posts to an unrelated domain" is among the
-        # strongest phishing signals it emits. "download" deliberately does not,
-        # because a document download page is not evidence of malware.
+        # Three fields are read, because the risk factors alone are the weakest of
+        # them. A live run on 2026-09-01 returned the verdict "High Risk (Credential
+        # Phishing on disposable hosting)" and `threat_categories: ["Credential
+        # Phishing"]`, while its single risk factor named only the flagged IPs, so
+        # matching factors alone tagged an outright credential-phishing page with
+        # nothing. `threat_categories` is the structured field and the one to trust;
+        # the other two are prose and are matched as a fallback.
+        #
+        # "credential" earns its keyword place: "Credential form posts to an
+        # unrelated domain" is among the strongest phishing signals emitted.
+        # "download" deliberately does not, because a document download page is
+        # not evidence of malware.
+        haystack = [str(f).lower() for f in factors]
+        haystack += [str(c).lower() for c in (verdict.get("threat_categories") or [])]
+        haystack.append(str(verdict.get("verdict") or "").lower())
+
         tags = set()
-        for factor in factors:
-            text = str(factor).lower()
+        for text in haystack:
             if any(k in text for k in ("phish", "impersonation", "lure", "credential")):
                 tags.add(DataModelTags.PHISHING.value)
             if any(k in text for k in ("malware", "trojan", "ransomware", "payload", "drive-by")):

tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_scanmalware.py

@@ -245,6 +245,55 @@ def test_high_risk_is_reported_as_malicious(self):
         self.assertEqual(dm.tags, ["phishing"])
         self.assertEqual(dm.additional_info["risk_level"], "high")
 
+    def test_phishing_is_tagged_from_the_structured_category(self):
+        # Shape taken from a live 2026-09-01 run: the verdict and threat_categories
+        # both say credential phishing while the only risk factor names the flagged
+        # IPs. Matching risk factors alone left this page untagged.
+        dm = self._mapped(
+            {
+                "verdict": "High Risk (Credential Phishing on disposable hosting)",
+                "risk_level": "high",
+                "confidence": 75,
+                "threat_categories": ["Credential Phishing"],
+                "risk_factors": ["References flagged external domain(s): 43.174.246.29"],
+            }
+        )
+        self.assertEqual(dm.tags, ["phishing"])
+
+    def test_a_clean_verdict_is_tagged_with_nothing(self):
+        # The fallback reads free text, so it has to stay quiet on a benign report.
+        dm = self._mapped(
+            {
+                "verdict": "Low Risk",
+                "risk_level": "low",
+                "confidence": 40,
+                "threat_categories": [],
+                "risk_factors": ["Document download page"],
+            }
+        )
+        self.assertIsNone(dm.tags)
+
+    def test_every_risk_level_the_archive_emits_is_mapped(self):
+        # Sampled from the live archive on 2026-09-01: low 74, malicious 14, high 9,
+        # medium 2, critical 0. `malicious` is the scanner's strongest level, not a
+        # synonym for `high`, and it was originally missed: a site called outright
+        # Malicious at 95% confidence set no evaluation at all, while `critical`,
+        # the value that WAS being checked, is one this API has never been seen to
+        # emit. Enumerate the real vocabulary here so a future edit cannot quietly
+        # drop one of them again.
+        for level, expected in (
+            ("malicious", "malicious"),
+            ("critical", "malicious"),
+            ("high", "malicious"),
+            ("medium", None),
+            ("low", None),
+        ):
+            with self.subTest(risk_level=level):
+                dm = self._mapped(
+                    {"verdict": level.title(), "risk_level": level, "confidence": 95, "risk_factors": []}
+                )
+                self.assertEqual(dm.evaluation, expected)
+
     @staticmethod
     def _high_risk(confidence):
         return {"verdict": "High Risk", "risk_level": "high", "confidence": confidence, "risk_factors": []}