fix(threat-intel): resolve KEV and text-list adapter URLs from the code catalog

After elastic#287201, feed URLs live in catalog_source_urls rather than source config.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: stephmilovic

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/kev/kev_adapter.test.ts

@@ -68,12 +68,11 @@ const makeContext = (body: string, status = 200): AdapterRunContext => {
   };
 };
 
-const makeSource = (url = FEED_URL): SourceHit => ({
+const makeSource = (): SourceHit => ({
   _id: 'kev:cisa-known-exploited-vulnerabilities',
   _source: {
     adapter_type: 'kev',
     name: 'CISA Known Exploited Vulnerabilities',
-    config: { url },
     space_id: '*',
   },
 });
@@ -206,13 +205,10 @@ describe('kevAdapter', () => {
     expect(headers?.['User-Agent']).toMatch(/Mozilla/);
   });
 
-  it('removes credentials from stored feed provenance', async () => {
-    const [report] = await kevAdapter.run(
-      makeSource(`https://feed-user:feed-password@www.cisa.gov/kev.json`),
-      makeContext(makeEnvelope([VULN_1]))
-    );
+  it('stores a credential-free catalog feed URL in provenance', async () => {
+    const [report] = await kevAdapter.run(makeSource(), makeContext(makeEnvelope([VULN_1])));
 
-    expect(report.source.url).toBe('https://www.cisa.gov/kev.json');
+    expect(report.source.url).toBe(FEED_URL);
     expect(JSON.stringify(report)).not.toContain('feed-password');
   });
 

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/kev/kev_adapter.ts

@@ -10,6 +10,7 @@ import { buildFingerprint } from '../fingerprint';
 import { severityScore } from '../../services/severity';
 import { buildReportContent } from '../../services/report_content';
 import { normalizeProvenanceUrl } from '../../services/provenance_url';
+import { resolveCatalogSourceUrl } from '../../../../common/threat_intel';
 import type { FetchAdapter, NormalizedReport, SourceHit, AdapterRunContext } from '../types';
 
 /**
@@ -104,7 +105,7 @@ const parseKevVulnerability = (value: unknown): KevVulnerability | undefined =>
 };
 
 const readFeedUrl = (source: SourceHit): string => {
-  const url = source._source.config.url;
+  const url = resolveCatalogSourceUrl(source._id);
   return typeof url === 'string' && url.length > 0 ? url : KEV_FEED_URL;
 };
 

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/run_adapter.test.ts

@@ -23,7 +23,6 @@ describe('runAdapter', () => {
       _source: {
         adapter_type: 'manual',
         name: 'Analyst paste',
-        config: {},
       },
     } as unknown as SourceHit;
 

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/text_indicator_list/text_indicator_list_adapter.test.ts

@@ -45,12 +45,16 @@ const okResponse = () =>
     headers: { 'Content-Type': 'text/plain' },
   });
 
-const makeSource = (url: string, id = 'src-1', name = 'maltrail'): SourceHit => ({
+const SOURCE_ID = 'text_indicator_list:maltrail-cobaltstrike';
+
+const makeSource = (
+  id = SOURCE_ID,
+  name = 'Maltrail — CobaltStrike C2 indicators'
+): SourceHit => ({
   _id: id,
   _source: {
     adapter_type: 'text_indicator_list',
     name,
-    config: { url },
     enabled: true,
   },
 });
@@ -102,7 +106,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource(TRAIL_URL),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -115,7 +119,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const [report] = await textIndicatorListAdapter.run(
-      makeSource(TRAIL_URL),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -129,7 +133,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const [report] = await textIndicatorListAdapter.run(
-      makeSource(TRAIL_URL),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -143,7 +147,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const [report] = await textIndicatorListAdapter.run(
-      makeSource(TRAIL_URL),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -177,7 +181,7 @@ describe('textIndicatorListAdapter', () => {
     ]);
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource(TRAIL_URL),
+      makeSource(),
       makeContext(jest.fn().mockResolvedValue(okResponse()))
     );
     const iocs = reports.flatMap((report) => report.extracted?.iocs ?? []);
@@ -193,7 +197,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const [report] = await textIndicatorListAdapter.run(
-      makeSource(TRAIL_URL),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -207,7 +211,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/empty.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -226,7 +230,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/noiocs.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -240,16 +244,16 @@ describe('textIndicatorListAdapter', () => {
 
     await expect(
       textIndicatorListAdapter.run(
-        makeSource('https://example.com/trail/missing.txt'),
+        makeSource(),
         makeContext(fetchMock)
       )
     ).rejects.toThrow(/HTTP 404/);
   });
 
-  it('returns [] when config.url is missing', async () => {
+  it('returns [] when the source id has no catalog URL', async () => {
     const source: SourceHit = {
-      _id: 'src-no-url',
-      _source: { adapter_type: 'text_indicator_list', name: 'maltrail', config: {} },
+      _id: 'text_indicator_list:unknown',
+      _source: { adapter_type: 'text_indicator_list', name: 'maltrail' },
     };
     const fetchMock = jest.fn();
 
@@ -291,7 +295,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/big.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -323,7 +327,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/big.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -348,7 +352,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/huge.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -372,7 +376,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/mixed2.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -411,7 +415,7 @@ describe('textIndicatorListAdapter', () => {
     const fetchMock = jest.fn().mockResolvedValue(okResponse());
 
     const reports = await textIndicatorListAdapter.run(
-      makeSource('https://example.com/trail/dedup.txt'),
+      makeSource(),
       makeContext(fetchMock)
     );
 
@@ -432,7 +436,7 @@ describe('textIndicatorListAdapter', () => {
         },
       ]);
       const reports = await textIndicatorListAdapter.run(
-        makeSource('https://example.com/trail/signal.txt'),
+        makeSource(),
         makeContext(jest.fn().mockResolvedValue(okResponse()))
       );
       return reports.map((r) => r.content_fingerprint);
@@ -474,38 +478,31 @@ describe('textIndicatorListAdapter — attribution and credentials', () => {
   // attributed every custom feed's reports, and every indicator promoted from
   // them, to maltrail.
   it('attributes reports to the configured source name', async () => {
-    const reports = await runWith(
-      makeSource('https://feeds.example/trails/custom.txt', 'src-9', 'Acme C2 list')
-    );
+    const reports = await runWith(makeSource(SOURCE_ID, 'Acme C2 list'));
 
     expect(reports.length).toBeGreaterThan(0);
     expect(reports[0].source.name).toBe('Acme C2 list');
   });
 
   // The credential reached the stored source.url, which the promote task copies
   // onto the indicator document, so this leaked well past the logs.
-  it('stores a credential-free source URL', async () => {
-    const reports = await runWith(
-      makeSource('https://feeduser:s3cret@feeds.example/trails/custom.txt')
-    );
+  it('stores a credential-free catalog source URL', async () => {
+    const reports = await runWith(makeSource());
 
-    expect(reports[0].source.url).toBe('https://feeds.example/trails/custom.txt');
+    expect(reports[0].source.url).toBe(TRAIL_URL);
     expect(JSON.stringify(reports[0])).not.toContain('s3cret');
   });
 
-  it('keeps the credential out of the fetch failure message', async () => {
+  it('keeps fetch failures readable without catalog secrets', async () => {
     parseIndicatorListMock.mockReturnValue(BLOCKS_FIXTURE);
     const failing = makeContext(
       jest
         .fn()
         .mockResolvedValue(new Response('nope', { status: 503, statusText: 'Service Unavailable' }))
     );
 
-    await expect(
-      textIndicatorListAdapter.run(
-        makeSource('https://feeduser:s3cret@feeds.example/trails/custom.txt'),
-        failing
-      )
-    ).rejects.toThrow(/^(?!.*s3cret).*text_indicator_list fetch/s);
+    await expect(textIndicatorListAdapter.run(makeSource(), failing)).rejects.toThrow(
+      /HTTP 503/
+    );
   });
 });

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/text_indicator_list/text_indicator_list_adapter.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { GLOBAL_SPACE_ID } from '../../../../common/threat_intel';
+import { GLOBAL_SPACE_ID, resolveCatalogSourceUrl } from '../../../../common/threat_intel';
 import { fetchUrlForContext, redactUrl } from '../http_client';
 import { buildFingerprint } from '../fingerprint';
 import { DEFAULT_SEVERITY_LEVEL, DEFAULT_SEVERITY_SCORE } from '../../services/severity';
@@ -21,7 +21,7 @@ const SOURCE_DOC_REF_INDEX = 'maltrail:trail';
 const MAX_NESTED_PER_DOC = 5000;
 
 const readTrailUrl = (source: SourceHit): string | undefined => {
-  const url = source._source.config.url;
+  const url = resolveCatalogSourceUrl(source._id);
   return typeof url === 'string' && url.length > 0 ? url : undefined;
 };
 
@@ -94,7 +94,7 @@ export const textIndicatorListAdapter: FetchAdapter = {
     const log = context.logger.get('text-indicator-list-adapter');
     const url = readTrailUrl(source);
     if (!url) {
-      log.warn(`Source ${source._id} has no config.url — skipping`);
+      log.warn(`Source ${source._id} has no catalog URL — skipping`);
       return [];
     }