fix(threat-intel): resolve RSS adapter URLs from the code catalog

After #287201, feed URLs live in catalog_source_urls rather than source config.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: stephmilovic

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/rss/rss_adapter.test.ts

@@ -6,11 +6,13 @@
  */
 
 import { loggingSystemMock } from '@kbn/core/server/mocks';
+import { CATALOG_SOURCE_URLS } from '../../../../common/threat_intel';
 import { extractIocs } from '../../services/extract_iocs';
 import { rssAdapter } from './rss_adapter';
 import type { AdapterRunContext, SourceHit } from '../types';
 
-const FEED_URL = 'https://acme.example/feed.xml';
+const SOURCE_ID = 'vendor_api:elastic-security-labs';
+const FEED_URL = CATALOG_SOURCE_URLS[SOURCE_ID];
 const FEED_BODY = `<?xml version="1.0" encoding="UTF-8"?>
 <rss version="2.0"><channel>
   <title>Acme</title>
@@ -31,11 +33,10 @@ const FEED_BODY = `<?xml version="1.0" encoding="UTF-8"?>
 </channel></rss>`;
 
 const buildSource = (overrides: Partial<SourceHit['_source']> = {}): SourceHit => ({
-  _id: 'rss:acme',
+  _id: SOURCE_ID,
   _source: {
     adapter_type: 'rss',
-    name: 'Acme',
-    config: { url: FEED_URL },
+    name: 'Elastic Security Labs',
     ...overrides,
   },
 });
@@ -73,9 +74,9 @@ describe('rssAdapter', () => {
       space_id: '*',
       source: {
         type: 'rss',
-        name: 'Acme',
+        name: 'Elastic Security Labs',
         url: 'https://acme.example/1',
-        adapter_id: 'rss:rss:acme',
+        adapter_id: 'rss:vendor_api:elastic-security-labs',
       },
       content: {
         title: 'Item one',
@@ -225,10 +226,10 @@ describe('rssAdapter', () => {
     expect(reports[0].space_id).toBe('team-a');
   });
 
-  it('returns [] when the source has no config.url', async () => {
+  it('returns [] when the source id has no catalog URL', async () => {
     const fetchMock = jest.fn();
     const reports = await rssAdapter.run(
-      buildSource({ config: {} as Record<string, unknown> }),
+      { _id: 'rss:unknown', _source: { adapter_type: 'rss', name: 'Unknown' } },
       buildContext(fetchMock)
     );
     expect(reports).toEqual([]);
@@ -250,18 +251,4 @@ describe('rssAdapter', () => {
     const reports = await rssAdapter.run(buildSource(), buildContext(fetchMock));
     expect(reports).toEqual([]);
   });
-
-  it('ingests percent-encoded data: fixture URLs without calling fetch', async () => {
-    const dataUrl = `data:application/rss+xml;charset=utf-8,${encodeURIComponent(FEED_BODY)}`;
-    const fetchMock = jest.fn();
-    const reports = await rssAdapter.run(
-      buildSource({ config: { url: dataUrl } }),
-      buildContext(fetchMock)
-    );
-
-    expect(fetchMock).not.toHaveBeenCalled();
-    expect(reports).toHaveLength(2);
-    expect(reports[0].content.title).toBe('Item one');
-    expect(reports[0].lineage.extraction_method).toBe('pending');
-  });
 });

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/rss/rss_adapter.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { GLOBAL_SPACE_ID } from '../../../../common/threat_intel';
+import { GLOBAL_SPACE_ID, resolveCatalogSourceUrl } from '../../../../common/threat_intel';
 import { fetchUrlForContext, redactUrl } from '../http_client';
 import { buildFingerprint } from '../fingerprint';
 import { DEFAULT_SEVERITY_LEVEL, DEFAULT_SEVERITY_SCORE } from '../../services/severity';
@@ -21,7 +21,7 @@ const BODY_TEXT_MAX_LENGTH = 32_000;
 const SOURCE_DOC_REF_INDEX = 'rss:feed';
 
 const readFeedUrl = (source: SourceHit): string | undefined => {
-  const url = source._source.config.url;
+  const url = resolveCatalogSourceUrl(source._id);
   return typeof url === 'string' && url.length > 0 ? url : undefined;
 };
 
@@ -58,7 +58,7 @@ export const rssAdapter: FetchAdapter = {
     const log = context.logger.get('rss-adapter');
     const feedUrl = readFeedUrl(source);
     if (!feedUrl) {
-      log.warn(`Source ${source._id} has no config.url — skipping`);
+      log.warn(`Source ${source._id} has no catalog URL — skipping`);
       return [];
     }
 

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/types.ts

@@ -26,7 +26,6 @@ export interface SourceHit {
     adapter_type: FetchAdapterType;
     name: string;
     enabled?: boolean;
-    config: Record<string, unknown>;
     tags?: string[];
     space_id?: string;
   };