Skip to content

[ShadowTrackr] Refactor connector with configuration and API integration #5294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jabesq merged 10 commits into from
Dec 10, 2025
Merged

[ShadowTrackr] Refactor connector with configuration and API integration #5294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c6a27ed
feat: Implement ShadowTrackr connector with configuration and API int…
jabesq Nov 27, 2025
ea40f77
chore: Update boilerplates and README
jabesq Dec 1, 2025
fb56512
chore: Delete old shadowtrackr connector
jabesq Dec 1, 2025
b8df019
chore: Add missing .env.sample file
jabesq Dec 1, 2025
86364e2
fix: Revert change of setting max_tlp into max_tlp_level
jabesq Dec 1, 2025
b080054
fix: Handle case `description` is missing
jabesq Dec 5, 2025
ef772f4
fix: Handle None score in entity
jabesq Dec 5, 2025
fce14bc
docs: Add Verified status in README and connector_manifest.json
jabesq Dec 5, 2025
7faa001
chore: Set `manager_supported` flag to True
jabesq Dec 8, 2025
3866adc
Revert "chore: Set `manager_supported` flag to True"
jabesq Dec 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions internal-enrichment/shadowtrackr/.env.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
OPENCTI_URL=http://localhost
OPENCTI_TOKEN=ChangeMe
CONNECTOR_ID=ChangeMe
CONNECTOR_NAME=ShadowTrackr
CONNECTOR_TYPE=INTERNAL_ENRICHMENT
CONNECTOR_SCOPE=IPv4-Addr,IPv6-Addr,Indicator
CONNECTOR_AUTO=true
CONNECTOR_LOG_LEVEL=error
SHADOWTRACKR_MAX_TLP=TLP:AMBER
SHADOWTRACKR_REPLACE_WITH_LOWER_SCORE=true # lower the score based on the ShadowTrackr false positive estimate
SHADOWTRACKR_REPLACE_VALID_TO_DATE=true
11 changes: 4 additions & 7 deletions internal-enrichment/shadowtrackr/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,14 @@
FROM python:3.12-alpine
ENV CONNECTOR_TYPE=INTERNAL_ENRICHMENT

# Copy the worker
COPY src /opt/opencti-connector-shadowtrackr
WORKDIR /opt/opencti-connector-shadowtrackr

# Install Python modules
# hadolint ignore=DL3003
RUN apk --no-cache add git build-base libmagic libffi-dev rust cargo openssl-dev && \
cd /opt/opencti-connector-shadowtrackr && \
RUN apk --no-cache add git libmagic && \
pip3 install --no-cache-dir -r requirements.txt && \
apk del git build-base rust cargo openssl-dev
apk del git

# Expose and entrypoint
COPY entrypoint.sh /
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD [ "python", "main.py" ]
8 changes: 8 additions & 0 deletions internal-enrichment/shadowtrackr/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
# OpenCTI ShadowTrackr Connector

## Status Filigran

| Status | Date | Comment |
|-------------------|------------|---------|
| Filigran Verified | 2025-12-10 | - |

----

This internal enrichment connector lowers the score for IP addresses that are
false positives, and changes the valid until date for sources
that are known to change function regularly, like CDNs, Clouds and VPNs.
Expand Down
4 changes: 2 additions & 2 deletions internal-enrichment/shadowtrackr/__metadata__/connector_manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
"use_cases": [
"Enrichment & Analysis"
],
"verified": false,
"last_verified_date": null,
"verified": true,
"last_verified_date": "2025-12-05",
"playbook_supported": true,
"max_confidence_level": 50,
"support_version": ">=6.3.2",
Expand Down
1 change: 0 additions & 1 deletion internal-enrichment/shadowtrackr/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ services:
- CONNECTOR_TYPE=INTERNAL_ENRICHMENT
- CONNECTOR_SCOPE=IPv4-Addr,IPv6-Addr,Indicator
- CONNECTOR_AUTO=true
- CONNECTOR_CONFIDENCE_LEVEL=70 # From 0 (Unknown) to 100 (Fully trusted)
- CONNECTOR_LOG_LEVEL=error
- SHADOWTRACKR_MAX_TLP=TLP:AMBER
- SHADOWTRACKR_REPLACE_WITH_LOWER_SCORE=true # lower the score based on the ShadowTrackr false positive estimate
Expand Down
7 changes: 0 additions & 7 deletions internal-enrichment/shadowtrackr/entrypoint.sh
View file
Open in desktop

This file was deleted.

2 changes: 0 additions & 2 deletions internal-enrichment/shadowtrackr/src/config.yml.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,12 @@ opencti:
url: 'http://localhost:8080'
token: 'ChangeMe'


connector:
id: 'ChangeMe'
type: 'INTERNAL_ENRICHMENT'
name: 'ShadowTrackr'
scope: 'IPv4-Addr,IPv6-Addr,Indicator'
auto: true # Enable/disable auto-enrichment of observables
confidence_level: 70 # From 0 (Unknown) to 100 (Fully trusted)
log_level: 'info'

shadowtrackr:
Expand Down
6 changes: 6 additions & 0 deletions internal-enrichment/shadowtrackr/src/connector/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
"""ShadowTrackr Connector package"""

from .connector import ShadowTrackrConnector
from .settings import ConnectorSettings

__all__ = ["ShadowTrackrConnector", "ConnectorSettings"]
Loading