Repository navigation
chg: [sandbox-report] add enrichment sandbox provider defaults - #552
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 70685f8da0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "symantec-cas-cloud" | ||
| "symantec-cas-cloud", | ||
| "any.run", | ||
| "hatching-triage" |
There was a problem hiding this comment.
When this value represents the standard tria.ge Hatching Triage service, every submission and report is publicly visible, which matches this template's web-sandbox definition rather than saas-sandbox's explicitly non-public semantics; Hatching's private service uses separate private endpoints. Listing hatching-triage only here therefore steers users toward recording the wrong sandbox relation for public Triage reports. Add it to web-sandbox, or use distinct defaults for public and private Triage deployments. Triage's official FAQ documents the visibility distinction.
Useful? React with 👍 / 👎.
Add ANY.RUN to the SaaS sandbox suggestions; CAPE, FortiSandbox and GLIMPS Detect to the on-premise suggestions; and Hatching Triage to the public web-sandbox suggestions. Increment the template version to 3 while preserving its UUID, required relations and existing values.
Public tria.ge reports belong under web-sandbox: Triage's official FAQ states that all submissions on that service are publicly visible. Private enterprise deployments are distinct and should not be inferred from the public-service default. See https://tria.ge/docs/faq/.
The enrichment adapters can use the existing sandbox-report template with the appropriate sandbox-type and provider relation. No new object type is necessary.
CI repair: normalise the JSON with jq -S -j, including the repository's no-trailing-newline convention. The original failure occurred when validate_all.sh detected a file changed by its normaliser, before schema validation.
Local validation: all 454 object definitions and the relationship catalogue pass schema validation; all 22 relationship tests, opposite validation and UUID uniqueness pass; all definitions match normalisation and JSON files have no executable bit. Existing provider suggestions, template UUID and requirement lists are preserved.