Skip to content

feat(google-ti-feeds): enable IOC fetching for campaigns (#5793)#6785

Open
romain-filigran wants to merge 2 commits into
masterfrom
feat/5793-1
Open

feat(google-ti-feeds): enable IOC fetching for campaigns (#5793)#6785
romain-filigran wants to merge 2 commits into
masterfrom
feat/5793-1

Conversation

@romain-filigran

Copy link
Copy Markdown
Member

Proposed changes

add "domains", "files", "urls" and "ip_addresses" to campaign subentity types, allowing the campaign orchestrator to fetch and convert IOCs alongside existing relationships. Update test expectations
accordingly.

Related issues

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key.
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

Copilot AI review requested due to automatic review settings June 20, 2026 09:55
@Filigran-Automation Filigran-Automation added the filigran team Item from the Filigran team. label Jun 20, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR extends the Google Threat Intelligence (GTI) Feeds connector’s campaign orchestration to fetch and convert additional IoC-related subentities (beyond the existing campaign relationships), aligning campaign ingestion more closely with the connector’s broader relationship-fetching approach.

Changes:

  • Enabled campaign subentity fetching for domains, files, urls, and ip_addresses in the campaign orchestrator.
  • Updated orchestration test expectations to account for the newly fetched/converted campaign IoC relationships (as exercised by the existing stubs).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
external-import/google-ti-feeds/connector/src/custom/orchestrators/campaign/orchestrator_campaign.py Adds IoC subentity types to the campaign relationship fetch list so the orchestrator can retrieve/convert them.
external-import/google-ti-feeds/tests/custom/test_orchestrator.py Updates expected log/message counts to reflect additional campaign IoC processing from the stubs.

Comment on lines +86 to +89
"domains",
"files",
"urls",
"ip_addresses",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

filigran team Item from the Filigran team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(google-ti): support fetching and modeling indicators associated with campaigns

4 participants