psengine 2.9.0__tar.gz → 2.10.0__tar.gz

{psengine-2.9.0 → psengine-2.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.9.0
+Version: 2.10.0
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Keywords: API,Recorded Future,Cyber Security Engineering,Threat Intelligence
 Author: Moise Medici, Patrick Kinsella, Ernest Bartosevic

{psengine-2.9.0 → psengine-2.10.0}/psengine/classic_alerts/classic_alert.py

@@ -208,6 +208,7 @@ class ClassicAlert(RFBaseModel):
         html_tags: Annotated[bool, Doc('Include HTML tags in the markdown.')] = False,
         character_limit: Annotated[int | None, Doc('Character limit for the markdown.')] = None,
         defang_iocs: Annotated[bool, Doc('Defang IOCs in hits.')] = False,
+        comment: Annotated[bool, Doc('Include reviewer note in the markdown.')] = False,
     ) -> Annotated[str, Doc('Markdown representation of the alert.')]:
         """Return a markdown string representation of the `ClassicAlert` instance.
 
@@ -229,6 +230,7 @@ class ClassicAlert(RFBaseModel):
             html_tags=html_tags,
             character_limit=character_limit,
             defang_iocs=defang_iocs,
+            comment=comment,
         )
 
     @property

{psengine-2.9.0 → psengine-2.10.0}/psengine/classic_alerts/markdown/markdown.py

@@ -306,6 +306,13 @@ def _add_hits_section_if_no_enriched_entities(
         )
 
 
+def _add_comment_section(
+    md_maker: MarkdownMaker, classic_alert: 'ClassicAlert', comment: bool
+) -> None:
+    if comment and classic_alert.review.note:
+        md_maker.add_section('Reviewer Note', classic_alert.review.note)
+
+
 def _markdown_alert(
     classic_alert: 'ClassicAlert',
     owner_org: bool = False,
@@ -315,6 +322,7 @@ def _markdown_alert(
     html_tags: bool = False,
     character_limit: int = None,
     defang_iocs: bool = False,
+    comment: bool = False,
 ) -> str:
     """Returns a markdown string representation of the `ClassicAlert` instance.
 
@@ -331,6 +339,7 @@ def _markdown_alert(
         html_tags (bool, optional): Include HTML tags in the markdown. Defaults to False.
         character_limit (int, optional): Character limit for the markdown. Defaults to None.
         defang_iocs (bool, optional): Defang IOCs in hits. Defaults to False.
+        comment (bool, optional): Include reviewer note in the markdown. Defaults to False.
 
     Raises:
         AlertMarkdownError: If fields are not available.
@@ -351,6 +360,7 @@ def _markdown_alert(
         _add_summary_section(md_maker, classic_alert)
         _add_owner_org_section(md_maker, classic_alert, owner_org)
         _add_ai_insights_section(md_maker, classic_alert, ai_insights)
+        _add_comment_section(md_maker, classic_alert, comment)
 
         if classic_alert.enriched_entities:
             _add_enriched_entities_sections(md_maker, classic_alert, triggered_by, html_tags)

{psengine-2.9.0 → psengine-2.10.0}/psengine/endpoints.py

@@ -53,10 +53,13 @@ EP_PLAYBOOK_ALERT = BASE_URL + '/playbook-alert'
 EP_PLAYBOOK_ALERT_SEARCH = EP_PLAYBOOK_ALERT + '/search'
 EP_PLAYBOOK_ALERT_COMMON = EP_PLAYBOOK_ALERT + '/common'
 EP_PLAYBOOK_ALERT_CODE_REPO_LEAKAGE = EP_PLAYBOOK_ALERT + '/code_repo_leakage'
+EP_PLAYBOOK_ALERT_COMPROMISED_BANK_CHECKS = EP_PLAYBOOK_ALERT + '/compromised_bank_checks'
 EP_PLAYBOOK_ALERT_CYBER_VULNERABILITY = EP_PLAYBOOK_ALERT + '/vulnerability'
 EP_PLAYBOOK_ALERT_DOMAIN_ABUSE = EP_PLAYBOOK_ALERT + '/domain_abuse'
 EP_PLAYBOOK_ALERT_GEOPOLITICS_FACILITY = EP_PLAYBOOK_ALERT + '/geopolitics_facility'
 EP_PLAYBOOK_ALERT_IDENTITY_NOVEL_EXPOSURES = EP_PLAYBOOK_ALERT + '/identity_novel_exposures'
+EP_PLAYBOOK_ALERT_MALICIOUS_SITES = EP_PLAYBOOK_ALERT + '/malicious_sites'
+EP_PLAYBOOK_ALERT_MALICIOUS_SITES_CREATE = EP_PLAYBOOK_ALERT_MALICIOUS_SITES + '/create'
 EP_PLAYBOOK_ALERT_THIRD_PARTY_RISK = EP_PLAYBOOK_ALERT + '/third_party_risk'
 EP_PLAYBOOK_ALERT_MALWARE_REPORT = EP_PLAYBOOK_ALERT + '/malware_report'
 
@@ -72,6 +75,8 @@ EP_ENTITY_LOOKUP = BASE_URL + '/entity-match/entity/{}'
 EP_LIST = BASE_URL + '/list'
 EP_CREATE_LIST = EP_LIST + '/create'
 EP_SEARCH_LIST = EP_LIST + '/search'
+EP_LIST_ENTITIES_WITH_TAGS = EP_LIST + '/{}/entitiesWithTags'
+EP_LIST_ENTITY_TAGS = EP_LIST + '/{}/entity/tags'
 
 ###############################################################################
 # SOAR Endpoints

{psengine-2.9.0 → psengine-2.10.0}/psengine/entity_lists/__init__.py

@@ -11,6 +11,20 @@
 # accessed from any third party API.                                                         #
 ##############################################################################################
 
-from .entity_list import EntityList, ListEntity, ListInfoOut, ListStatusOut
+from .constants import ListTagName
+from .entity_list import (
+    EntityList,
+    ListEntity,
+    ListEntityWithTags,
+    ListInfoOut,
+    ListStatusOut,
+)
 from .entity_list_mgr import EntityListMgr
 from .errors import ListApiError, ListResolutionError, ListStateError
+from .models import (
+    EntityNotResolvedOperation,
+    ListEntityTag,
+    ReplaceEntityTagsOut,
+    TagsUnchangedOperation,
+    TagsUpdatedOperation,
+)

psengine-2.10.0/psengine/entity_lists/constants.py

@@ -0,0 +1,90 @@
+##################################### TERMS OF USE ###########################################
+# The following code is provided for demonstration purpose only, and should not be used      #
+# without independent verification. Recorded Future makes no representations or warranties,  #
+# express, implied, statutory, or otherwise, regarding any aspect of this code or of the     #
+# information it may retrieve, and provides it both strictly “as-is” and without assuming    #
+# responsibility for any information it may retrieve. Recorded Future shall not be liable    #
+# for, and you assume all risk of using, the foregoing. By using this code, Customer         #
+# represents that it is solely responsible for having all necessary licenses, permissions,   #
+# rights, and/or consents to connect to third party APIs, and that it is solely responsible  #
+# for having all necessary licenses, permissions, rights, and/or consents to any data        #
+# accessed from any third party API.                                                         #
+##############################################################################################
+
+from enum import Enum
+
+IS_READY_INCREMENT = 5
+
+ADD_OP = 'add'
+REMOVE_OP = 'remove'
+UNCHANGED_NAME = 'unchanged'
+ERROR_NAME = 'error'
+
+
+class ListTagName(str, Enum):
+    """The 57 predefined tag values accepted by `list/{id}/entity/tags`.
+
+    Provided for discoverability only - `update_entity_tags` accepts plain strings too,
+    and the API is the authority on which values are valid. `name` values here are the
+    API values (`tier1`), not display names (`Tier 1`).
+
+    See https://docs.recordedfuture.com/reference/lists-available-tags.
+    """
+
+    THIRD_PARTY = '3rd_party'
+    FOURTH_PARTY = '4th_party'
+    AVAILABILITY = 'availability'
+    BUSINESS_CONTINUITY = 'business_continuity'
+    C_SUITE = 'c_suite'
+    CEO = 'ceo'
+    CFO = 'cfo'
+    CLOUD = 'cloud'
+    CONFIDENTIAL_DATA = 'confidential_data'
+    CONFIDENTIALITY = 'confidentiality'
+    CONFIRMED = 'confirmed'
+    COO = 'coo'
+    CRITICAL = 'critical'
+    CRITICAL_INFRASTRUCTURE = 'critical_infrastructure'
+    CUSTOMER_DATA = 'customer_data'
+    CYBER_VENDOR = 'cyber_vendor'
+    DEVELOPMENT = 'development'
+    DMZ = 'dmz'
+    DORA = 'dora'
+    ECOMMERCE = 'ecommerce'
+    EOL = 'eol'
+    EOS = 'eos'
+    FALSE_NEGATIVE = 'false_negative'
+    FALSE_POSITIVE = 'false_positive'
+    FINANCIAL = 'financial'
+    FINISHED_GOODS = 'finished_goods'
+    GDPR = 'gdpr'
+    HIGH = 'high'
+    HIPAA = 'hipaa'
+    INFORMATION_AND_COMMUNICATION_TECHNOLOGY = 'information_and_communication_technology'
+    INTEGRITY = 'integrity'
+    INTERNAL = 'internal'
+    INTERNET_FACING = 'internet_facing'
+    ISO_27001 = 'iso_27001'
+    LOW = 'low'
+    M_AND_A = 'm_and_a'
+    MEDIUM = 'medium'
+    MONITORING = 'monitoring'
+    MOST_CRITICAL_SUPPLIER = 'most_critical_supplier'
+    NETWORK_CONNECTIVITY = 'network_connectivity'
+    NO_PATCH_AVAILABLE = 'no_patch_available'
+    PCI_DSS = 'pci_dss'
+    PII = 'pii'
+    POTENTIAL = 'potential'
+    PRODUCTION = 'production'
+    PROTECTED_HEALTH_INFORMATION = 'protected_health_information'
+    RAW_MATERIALS = 'raw_materials'
+    SOX = 'sox'
+    SUBSIDIARY = 'subsidiary'
+    TEMP_INCIDENT = 'temp_incident'
+    TIER0 = 'tier0'
+    TIER1 = 'tier1'
+    TIER2 = 'tier2'
+    TIER3 = 'tier3'
+    TRUE_NEGATIVE = 'true_negative'
+    TRUE_POSITIVE = 'true_positive'
+    UNPATCHED = 'unpatched'

{psengine-2.9.0 → psengine-2.10.0}/psengine/entity_lists/entity_list.py

@@ -22,7 +22,7 @@ from typing_extensions import Doc
 
 from ..common_models import IdNameType, RFBaseModel
 from ..constants import TIMESTAMP_STR
-from ..endpoints import EP_LIST
+from ..endpoints import EP_LIST, EP_LIST_ENTITIES_WITH_TAGS, EP_LIST_ENTITY_TAGS
 from ..entity_match import EntityMatchMgr, MatchApiError
 from ..helpers import debug_call
 from ..helpers.helpers import connection_exceptions
@@ -31,9 +31,13 @@ from .constants import ADD_OP, ERROR_NAME, IS_READY_INCREMENT, REMOVE_OP, UNCHAN
 from .errors import ListApiError
 from .models import (
     AddEntityRequestModel,
+    EntityNotResolvedOperation,
     ListEntityOperationResponse,
+    ListEntityTag,
     OwnerOrganisationDetails,
     RemoveEntityRequestModel,
+    ReplaceEntityTagsIn,
+    ReplaceEntityTagsOut,
 )
 
 
@@ -85,6 +89,17 @@ class ListEntity(RFBaseModel):
         )
 
 
+class ListEntityWithTags(ListEntity):
+    """Validate data received from `/{listId}/entitiesWithTags` endpoint.
+
+    Identical to `ListEntity`, with the addition of the list-specific `tags` assigned to the
+    entity. Tags are predefined and only populated for lists whose type has tagging enabled -
+    see `ListEntityTag`.
+    """
+
+    tags: list[ListEntityTag] = []
+
+
 class EntityList(ListInfoOut):
     """Validate data received from `/create` endpoint."""
 
@@ -273,6 +288,99 @@ class EntityList(ListInfoOut):
         response = self.rf_client.request('get', url)
         return [ListEntity.model_validate(entity) for entity in response.json()]
 
+    @debug_call
+    @connection_exceptions(ignore_status_code=[], exception_to_raise=ListApiError)
+    def entities_with_tags(
+        self,
+    ) -> Annotated[
+        list[ListEntityWithTags],
+        Doc('Response from the `list/{id}/entitiesWithTags` endpoint.'),
+    ]:
+        """Get entities for a list, together with their list-specific tags.
+
+        Tags are **not** free-text. They are a fixed set of 57 predefined values, so arbitrary
+        tag strings cannot be expected. See
+        https://docs.recordedfuture.com/reference/lists-available-tags for the full list of valid
+        tags, their display names, and their API values.
+
+        `tags` is only populated for lists whose type has tagging enabled server-side (currently
+        Third-Parties Watch Lists). A list of any other type returns its entities with an empty
+        `tags` list rather than an error, so an empty `tags` does not indicate a failure. A list
+        whose type supports tagging but which has not yet been migrated server-side responds 400
+        instead.
+
+        Endpoint:
+            `list/{id}/entitiesWithTags`
+
+        Raises:
+            ListApiError: If connection error occurs. The API responds 400 if the list's type
+                supports tagging but the list has not been migrated to support tags, and 404 if
+                the list does not exist.
+        """
+        url = EP_LIST_ENTITIES_WITH_TAGS.format(self.id_)
+        response = self.rf_client.request('get', url)
+        return [ListEntityWithTags.model_validate(entity) for entity in response.json()]
+
+    @debug_call
+    @validate_call
+    @connection_exceptions(ignore_status_code=[], exception_to_raise=ListApiError)
+    def update_entity_tags(
+        self,
+        entity: Annotated[
+            str | tuple[str, str], Doc('ID or (name, type) tuple of the entity to tag.')
+        ],
+        tags: Annotated[
+            list[str],
+            Doc('Complete set of tags to apply. Replaces every tag already on the entity.'),
+        ],
+    ) -> Annotated[
+        ReplaceEntityTagsOut, Doc('Response from the `list/{id}/entity/tags` endpoint.')
+    ]:
+        """Replace all tags on an entity in a list.
+
+        This **replaces** rather than appends: `tags` becomes the entity's complete tag set,
+        and passing an empty list clears every tag from it.
+
+        Tags are **not** free-text. They are a fixed set of 57 predefined values - pass them as
+        plain strings or as `ListTagName` members. Invalid names are rejected by the API with a
+        400. See https://docs.recordedfuture.com/reference/lists-available-tags for the full
+        list.
+
+        Tagging is only enabled for lists whose type supports it (currently Third-Parties Watch
+        Lists); other list types respond 403.
+
+        If `entity` is a `(name, type)` tuple that cannot be resolved, the returned
+        `operation` is an `EntityNotResolvedOperation` rather than an exception, matching
+        `add` and `remove`.
+
+        Endpoint:
+            `list/{id}/entity/tags`
+
+        Raises:
+            ValidationError: if any supplied parameter is of incorrect type.
+            ListApiError: If connection error occurs. The API responds 400 for an invalid tag
+                name, entity, or list, 403 if tag updates are not enabled for the list type,
+                and 404 if the entity is not on the list.
+        """
+        if isinstance(entity, str):
+            resolved_entity_id = entity
+        else:
+            resolved_entity = self.match_mgr.resolve_entity_id(entity[0], entity_type=entity[1])
+            if not resolved_entity.is_found:
+                return ReplaceEntityTagsOut(
+                    operation=EntityNotResolvedOperation(
+                        status='entity_not_resolved', message=str(resolved_entity.content)
+                    )
+                )
+            resolved_entity_id = resolved_entity.content.id_
+
+        request_body = {'entity': {'id': resolved_entity_id}, 'tags': tags}
+        ReplaceEntityTagsIn.model_validate(request_body)
+
+        url = EP_LIST_ENTITY_TAGS.format(self.id_)
+        response = self.rf_client.request('post', url, data=request_body)
+        return ReplaceEntityTagsOut.model_validate(response.json())
+
     @debug_call
     @connection_exceptions(ignore_status_code=[], exception_to_raise=ListApiError)
     def text_entries(

{psengine-2.9.0 → psengine-2.10.0}/psengine/entity_lists/models.py

@@ -12,15 +12,33 @@
 ##############################################################################################
 
 
+from datetime import datetime
+from typing import Literal
+
 from pydantic import Field
 
-from ..common_models import RFBaseModel
+from ..common_models import IdName, RFBaseModel
 
 
 class EntityID(RFBaseModel):
     id_: str = Field(alias='id')
 
 
+class ListEntityTag(IdName):
+    """Validate a single tag received from `/{listId}/entitiesWithTags` endpoint.
+
+    Tags are **not** free-text. They are a fixed set of 57 predefined values, populated only for
+    lists whose type has tagging enabled (currently Third-Parties Watch Lists), so arbitrary tag
+    strings cannot be supplied or expected. `id` always has the form
+    `enum:EntityListTag:<name>`, for example `enum:EntityListTag:tier1`.
+
+    `name` is the tag's API value (`tier1`), not its display name (`Tier 1`).
+
+    See https://docs.recordedfuture.com/reference/lists-available-tags for the full list of
+    valid tags.
+    """
+
+
 class Organisation(RFBaseModel):
     organisation_id: str
     organisation_name: str
@@ -84,3 +102,67 @@ class ListEntityOperationResponse(RFBaseModel):
     """Validate data received from `/{listId}/entity/remove` endpoint."""
 
     result: str
+
+
+class TagsUpdatedOperation(RFBaseModel):
+    """Tags on the entity were changed."""
+
+    status: Literal['tags_updated']
+    tags_before: list[str]
+    tags_after: list[str]
+    tags_added: list[str]
+    tags_removed: list[str]
+    updated: datetime
+
+
+class TagsUnchangedOperation(RFBaseModel):
+    """Requested tags already matched the entity's tags, so nothing changed."""
+
+    status: Literal['tags_unchanged']
+    current_tags: list[str]
+    message: str
+
+
+class EntityNotResolvedOperation(RFBaseModel):
+    """A `(name, type)` tuple could not be resolved to an entity ID.
+
+    Produced by psengine, never returned by the API. Mirrors how `add` and `remove`
+    surface a failed lookup in their result rather than raising.
+    """
+
+    status: Literal['entity_not_resolved']
+    message: str
+
+
+class ReplaceEntityTagsIn(RFBaseModel):
+    """Validate data sent to `/{listId}/entity/tags` endpoint."""
+
+    entity: EntityID
+    tags: list[str]
+
+
+class ReplaceEntityTagsOut(RFBaseModel):
+    """Validate data received from `/{listId}/entity/tags` endpoint.
+
+    `operation` is discriminated on `status`, so each variant only exposes the fields the
+    API actually returns for it.
+    """
+
+    entity_id: str | None = None
+    operation: TagsUpdatedOperation | TagsUnchangedOperation | EntityNotResolvedOperation = Field(
+        discriminator='status'
+    )
+
+    @property
+    def changed(self) -> bool:
+        """Whether the call actually changed the entity's tags."""
+        return self.operation.status == 'tags_updated'
+
+    @property
+    def current_tags(self) -> list[str] | None:
+        """The entity's tags after the call, or None if the entity was not resolved."""
+        if isinstance(self.operation, TagsUpdatedOperation):
+            return self.operation.tags_after
+        if isinstance(self.operation, TagsUnchangedOperation):
+            return self.operation.current_tags
+        return None

{psengine-2.9.0 → psengine-2.10.0}/psengine/playbook_alerts/__init__.py

@@ -14,6 +14,7 @@
 from .constants import PBA_WITH_IMAGES_INST
 from .errors import (
     PlaybookAlertBulkFetchError,
+    PlaybookAlertCreateError,
     PlaybookAlertError,
     PlaybookAlertFetchError,
     PlaybookAlertRetrieveImageError,
@@ -30,6 +31,7 @@ from .playbook_alerts import (
     PBA_Generic,
     PBA_GeopoliticsFacility,
     PBA_IdentityNovelExposure,
+    PBA_MaliciousSites,
     PBA_MalwareReport,
     PBA_ThirdPartyRisk,
     PreviewAlertOut,

{psengine-2.9.0 → psengine-2.10.0}/psengine/playbook_alerts/constants.py

@@ -17,10 +17,12 @@ from ..constants import ROOT_DIR
 from ..playbook_alerts.pa_category import PACategory
 from .playbook_alerts import (
     PBA_CodeRepoLeakage,
+    PBA_CompromisedBankChecks,
     PBA_CyberVulnerability,
     PBA_DomainAbuse,
     PBA_GeopoliticsFacility,
     PBA_IdentityNovelExposure,
+    PBA_MaliciousSites,
     PBA_MalwareReport,
     PBA_ThirdPartyRisk,
 )
@@ -39,6 +41,7 @@ PLAYBOOK_ALERT_TYPE = (
     | PBA_ThirdPartyRisk
     | PBA_GeopoliticsFacility
     | PBA_MalwareReport
+    | PBA_MaliciousSites
 )
 
 PLAYBOOK_ALERT_INST = (
@@ -49,14 +52,25 @@ PLAYBOOK_ALERT_INST = (
     PBA_ThirdPartyRisk,
     PBA_GeopoliticsFacility,
     PBA_MalwareReport,
+    PBA_MaliciousSites,
 )
 
 
-PBA_WITH_IMAGES_TYPE = PBA_DomainAbuse | PBA_GeopoliticsFacility
+PBA_WITH_IMAGES_TYPE = (
+    PBA_DomainAbuse | PBA_GeopoliticsFacility | PBA_CompromisedBankChecks | PBA_MaliciousSites
+)
 PBA_WITH_IMAGES_VALIDATOR = (
-    Literal[PACategory.DOMAIN_ABUSE.value] | Literal[PACategory.GEOPOLITICS_FACILITY.value]
+    Literal[PACategory.DOMAIN_ABUSE.value]
+    | Literal[PACategory.GEOPOLITICS_FACILITY.value]
+    | Literal[PACategory.COMPROMISED_BANK_CHECKS.value]
+    | Literal[PACategory.MALICIOUS_SITES.value]
 )
 
-PBA_WITH_IMAGES_INST = (PBA_DomainAbuse, PBA_GeopoliticsFacility)
+PBA_WITH_IMAGES_INST = (
+    PBA_DomainAbuse,
+    PBA_GeopoliticsFacility,
+    PBA_CompromisedBankChecks,
+    PBA_MaliciousSites,
+)
 
 ALERTS_PER_PAGE = 50

{psengine-2.9.0 → psengine-2.10.0}/psengine/playbook_alerts/errors.py

@@ -37,3 +37,7 @@ class PlaybookAlertBulkFetchError(PlaybookAlertError):
 
 class PlaybookAlertRetrieveImageError(PlaybookAlertError):
     """Error raised when playbook alert image fetch fails."""
+
+
+class PlaybookAlertCreateError(PlaybookAlertError):
+    """Error raised when playbook alert creation fails."""

{psengine-2.9.0 → psengine-2.10.0}/psengine/playbook_alerts/mappings.py

@@ -13,40 +13,48 @@
 
 from ..endpoints import (
     EP_PLAYBOOK_ALERT_CODE_REPO_LEAKAGE,
+    EP_PLAYBOOK_ALERT_COMPROMISED_BANK_CHECKS,
     EP_PLAYBOOK_ALERT_CYBER_VULNERABILITY,
     EP_PLAYBOOK_ALERT_DOMAIN_ABUSE,
     EP_PLAYBOOK_ALERT_GEOPOLITICS_FACILITY,
     EP_PLAYBOOK_ALERT_IDENTITY_NOVEL_EXPOSURES,
+    EP_PLAYBOOK_ALERT_MALICIOUS_SITES,
     EP_PLAYBOOK_ALERT_MALWARE_REPORT,
     EP_PLAYBOOK_ALERT_THIRD_PARTY_RISK,
 )
 from .pa_category import PACategory
 from .playbook_alerts import (
     PBA_CodeRepoLeakage,
+    PBA_CompromisedBankChecks,
     PBA_CyberVulnerability,
     PBA_DomainAbuse,
     PBA_GeopoliticsFacility,
     PBA_IdentityNovelExposure,
+    PBA_MaliciousSites,
     PBA_MalwareReport,
     PBA_ThirdPartyRisk,
 )
 
 CATEGORY_ENDPOINTS = {
     PACategory.CODE_REPO_LEAKAGE.value: EP_PLAYBOOK_ALERT_CODE_REPO_LEAKAGE,
+    PACategory.COMPROMISED_BANK_CHECKS.value: EP_PLAYBOOK_ALERT_COMPROMISED_BANK_CHECKS,
     PACategory.CYBER_VULNERABILITY.value: EP_PLAYBOOK_ALERT_CYBER_VULNERABILITY,
     PACategory.DOMAIN_ABUSE.value: EP_PLAYBOOK_ALERT_DOMAIN_ABUSE,
     PACategory.GEOPOLITICS_FACILITY.value: EP_PLAYBOOK_ALERT_GEOPOLITICS_FACILITY,
     PACategory.IDENTITY_NOVEL_EXPOSURES.value: EP_PLAYBOOK_ALERT_IDENTITY_NOVEL_EXPOSURES,
     PACategory.THIRD_PARTY_RISK.value: EP_PLAYBOOK_ALERT_THIRD_PARTY_RISK,
     PACategory.MALWARE_REPORT.value: EP_PLAYBOOK_ALERT_MALWARE_REPORT,
+    PACategory.MALICIOUS_SITES.value: EP_PLAYBOOK_ALERT_MALICIOUS_SITES,
 }
 
 CATEGORY_TO_OBJECT_MAP = {
     PACategory.CODE_REPO_LEAKAGE.value: PBA_CodeRepoLeakage,
+    PACategory.COMPROMISED_BANK_CHECKS.value: PBA_CompromisedBankChecks,
     PACategory.CYBER_VULNERABILITY.value: PBA_CyberVulnerability,
     PACategory.DOMAIN_ABUSE.value: PBA_DomainAbuse,
     PACategory.GEOPOLITICS_FACILITY.value: PBA_GeopoliticsFacility,
     PACategory.IDENTITY_NOVEL_EXPOSURES.value: PBA_IdentityNovelExposure,
     PACategory.THIRD_PARTY_RISK.value: PBA_ThirdPartyRisk,
     PACategory.MALWARE_REPORT.value: PBA_MalwareReport,
+    PACategory.MALICIOUS_SITES.value: PBA_MaliciousSites,
 }

{psengine-2.9.0 → psengine-2.10.0}/psengine/playbook_alerts/markdown/markdown.py

@@ -16,12 +16,15 @@ from ...markdown import (
     MarkdownMaker,
 )
 from ...markdown.markdown_strings import bold, link
+from ..models import panel_log
 from ..pa_category import PACategory
 from .markdown_code_repo import _code_repo_markdown
+from .markdown_compromised_bank_checks import _compromised_bank_check_markdown
 from .markdown_cyber_vulnerability import _cyber_vulnerability_markdown
 from .markdown_domain_abuse import _domain_abuse_markdown
 from .markdown_geopolitics_facility import _geopolitics_facility_markdown
 from .markdown_identity_exposure import _identity_exposure_markdown
+from .markdown_malicious_sites import _malicious_sites_markdown
 from .markdown_malware_report import _malware_report_markdown
 from .markdown_third_party_risk import _third_party_risk_markdown
 
@@ -37,6 +40,8 @@ MARKDOWN_BY_PBA_TYPE = {
     PACategory.GEOPOLITICS_FACILITY.value: _geopolitics_facility_markdown,
     PACategory.CYBER_VULNERABILITY.value: _cyber_vulnerability_markdown,
     PACategory.MALWARE_REPORT.value: _malware_report_markdown,
+    PACategory.MALICIOUS_SITES.value: _malicious_sites_markdown,
+    PACategory.COMPROMISED_BANK_CHECKS.value: _compromised_bank_check_markdown,
 }
 
 
@@ -67,6 +72,7 @@ def _markdown_playbook_alert(
     defang_iocs: bool = False,
     iocs_to_defang: list = None,
     extra_context: list = None,
+    comments: bool = False,
 ) -> str:
     md_maker = MarkdownMaker(
         addendum=TRUNCATE_COMMENT.format(
@@ -78,6 +84,17 @@ def _markdown_playbook_alert(
     )
     _generic_pba_summary(playbook_alert, md_maker)
 
+    if comments:
+        comment_lines = []
+        for entry in playbook_alert.panel_log_v2 or []:
+            for change in entry.changes:
+                if isinstance(change, panel_log.CommentChange):
+                    who = entry.author_name or 'Unknown'
+                    when = entry.created.strftime(TIMESTAMP_STR)
+                    comment_lines.append(f'{who} ({when}): {change.comment}\n\n')
+        if comment_lines:
+            md_maker.add_section('Comments', comment_lines)
+
     if markdown := MARKDOWN_BY_PBA_TYPE.get(playbook_alert.category, _unsupported_pba)(
         playbook_alert, md_maker, html_tags, extra_context
     ):