[adulau]

ONYPHE Summary omits ctiscan/ctiurl, whose layered field names differ from the flat datascan/riskscan/vulnscan model. Applying the wrong model can silently return no results; the previous vulnerability parser also discarded negative and uncertain verdicts.

Update both modules against the OpenAPI reference dated 2026-10-21:

• Basic onyphe defaults to Search: ctiscan for IP/hostname/CPE/certificate pivots, ctiurl for URLs, and riskscan/vulnscan for domains. mode=summary retains the previous IP/domain/hostname lookup.
• onyphe_full adds modern categories while retaining existing CTI categories. Category selection, history and timeout settings, quoted OQL values, projection, pagination, a 10,000-result ceiling and request pacing follow the specification.
• CTI hostname queries and output include dns.hostname plus forward/reverse DNS names. Layered CVEs come from component.cve, transport comes from app.transport, and X.509 serials use cert.serial.hex with a numeric fallback.
• New service observations preserve dates, independent component arrays, HTTP metadata, risk/verdict tags and original JSON. Reuse ip-port, x509, vulnerability and legacy domain-ip objects with service-specific references; serving IPs are never inferred as certificate SANs. Shared CVEs retain references to all relevant services.
• Only positive check verdicts or positive-only riskscan observations produce affects. Negative, uncertain and version-based verdicts use related-to, retaining exact source tags. Derived Search attributes have to_ids=false.
• Subscription denials produce partial-results comments; credential, credit, rate-limit, malformed-query and transport failures return errors.

Companion template: MISP/misp-objects#550. The identical definition is bundled for local parsing; install it in MISP before importing the new service objects. Migration, configuration and mapping notes are in documentation/expansion/onyphe.md.

Attribute enrichment uses bounded Search. Export, bulk Discovery and ASD distinct-value APIs remain separate workflows; the modules do not invoke them automatically.

Validation: 118 offline tests pass, including mocked HTTP through the real SDK for Bearer authentication, paging and pacing, strict PyMISP object validation, arrays, JSON preservation, verdicts, limits and error handling. Black, isort, flake8 and whitespace checks pass. The built wheel contains the exact bundled template. Upstream validation covers all 453 templates, UUID uniqueness, 323 relationship names/opposites and 22 tests. No live ONYPHE key was available.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T14:03:34.097500Z	d840e25	PR opened
🔒 Security Review	✅ Completed 2026-10-21T14:04:45.350173Z	d840e25	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d840e25857

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".