[adulau]

Summary

Add two modules for moving MISP indicators into IBM QRadar reference sets:

• qradar_reference_set_export exports one selected indicator type as a deduplicated, headerless CSV for Reference Set Management or a JSON array for tooling. It requires no QRadar connection. Counts and MISP provenance remain outside the import file.
• qradar_reference_set_publish is a blocking workflow action that adds or refreshes IDS-marked values in an existing reference set and explicit domain through the current API 20.0 reference_data_collections endpoints. Its distinct name allows both modules to coexist in the server's module registry.

A shared, network-free converter handles standard/bare/legacy event envelopes and object attributes. It supports IPv4, IPv6, domains/hostnames, URLs, MD5, SHA-1, SHA-256, SHA-512 and supported composites, with validation, normalization, deduplication and source references. Deleted data is excluded; the offline export offers an explicit non-IDS override. Port-qualified indicators are skipped so their constraints are not silently discarded.

Publishing behavior

• Read the console origin, authorized service token and optional CA bundle from the module server environment. Use HTTPS with TLS verification, no redirects and SEC/Version headers.
• Require a numeric collection ID and explicit numeric domain ID or SHARED. Domain 0 remains distinct from shared data; SHARED is serialized as JSON null and verified in the acknowledgement.
• Check the target collection ID and entry type before writes: IPv4 uses IP; IPv6 and case-sensitive URLs use ALN; domains and hashes accept ALN or ALNIC.
• Count HTTP 201 as created and HTTP 200 as updated only after checking the returned entry ID, collection, domain, value and source. Support credential-free dry runs and report partial failures without automatically retrying uncertain writes.
• Leave collection creation, type, expiry policy and withdrawal to QRadar administration. Re-publishing an existing value can update its source metadata, including values from another publisher; the source is a label rather than an ownership guard. Dedicated sets/domains are recommended.

The action accepts at most 100 unique selected values per invocation, uses 15-second request timeouts and checks a 240-second processing budget. No new dependencies or MISP object templates are required. Both modules include setup/API guides and generated catalog entries. The export advertises static CSV MIME/extension metadata; JSON downloads may need renaming.

API contracts were checked against IBM's IOC import instructions, set metadata API, and entry creation/update API.

Validation

• 177 new tests cover CSV/JSON formats, supported types/composites, real MISP objects, provenance, deletions, malformed input, explicit domain/shared scope, target compatibility, credentials/CA handling, acknowledgement validation, partial publication and deadlines. Includes actual requests serialization with mocked HTTP transport and module discovery/query endpoints.
• pytest -q tests/test_qradar_reference_set.py tests/test_sentinelone_ioc_publish.py tests/test_crowdstrike_ioc_publish.py tests/test_elastic_ecs_export.py tests/test_splunk_export.py: 529 passed, with one pre-existing Python deprecation warning.
• Black, isort and scoped flake8 checks pass; git diff --check passes.
• No live QRadar tenant was used. API permissions, GUI import and deployment-specific expiry behavior require deployment validation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T18:36:58.127582Z	9a10b44	PR opened
🔒 Security Review	✅ Completed 2026-10-18T18:40:08.921049Z	9a10b44	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.