Add pr comments

external-import/zerofox/src/collectors/mappers/c2DomainsToInfrastructure.py

@@ -14,7 +14,7 @@
 
 
 def c2_domains_to_infrastructure(
-    created_by: Identity,
+    created_by: str,
     now: str,
     entry: C2Domain,
 ) -> List[Union[Infrastructure, Relationship, IPv4Address, IPv6Address]]:

external-import/zerofox/src/main.py

@@ -7,7 +7,7 @@
 import stix2
 from collectors.builder import build_collectors
 from collectors.collector import Collector
-from pycti import OpenCTIConnectorHelper
+from pycti import Identity, OpenCTIConnectorHelper
 from time_.interval import delta_from_interval, seconds_from_interval
 from zerofox.app.zerofox import ZeroFox
 
@@ -16,6 +16,7 @@
     url="https://www.zerofox.com/threat-intelligence/",
     description="ZeroFox provides comprehensive, accurate, and timely intelligence bundles through its API.",
 )
+ZEROFOX = "ZeroFox"
 
 
 class ZeroFoxConnector:
@@ -44,8 +45,10 @@ def __init__(self):
             logger=self.helper.connector_logger,
         )
         self.author = stix2.Identity(
-            name="ZeroFox Connector",
+            id=Identity.generate_id(ZEROFOX, "organization"),
+            name=ZEROFOX,
             identity_class="organization",
+            object_marking_refs=[stix2.TLP_WHITE.id],
         )
 
     def _validate_interval(self, env_var, interval):
@@ -149,7 +152,7 @@ def collect_intelligence_for_endpoint(
             self.send_bundle(work_id=work_id, bundle_objects=[self.author])
             self.helper.log_info(f"Running collector: {collector_name}")
             missed_entries, bundle_objects = collector.collect_intelligence(
-                created_by=self.author,
+                created_by=self.author.id,
                 now=now,
                 last_run_date=datetime.fromtimestamp(last_run, UTC),
                 logger=self.helper.connector_logger,

external-import/zerofox/src/open_cti/observables.py

@@ -1,6 +1,6 @@
 from typing import Type
 
-from stix2 import Identity
+from stix2 import TLP_AMBER
 from stix2.base import _Observable
 
 main_observable_type = "x_opencti_main_observable_type"
@@ -21,11 +21,12 @@ def _get_observable_type(cls: Type[_Observable]) -> str:
     return _type
 
 
-def build_observable(created_by: Identity, cls: Type[_Observable], **kwargs):
+def build_observable(created_by: str, cls: Type[_Observable], **kwargs):
     return cls(
         **kwargs,
         custom_properties={
             main_observable_type: _get_observable_type(cls),
             created_by_ref: created_by,
         },
+        object_marking_refs=[TLP_AMBER.id],
     )