Conflict fix

external-import/socradar/README.md

@@ -1,41 +1,72 @@
 # OpenCTI SOCRadar Connector
 
-This connector imports threat intelligence feeds from SOCRadar into OpenCTI. It supports various types of indicators including IP addresses, domains, URLs, and file hashes.
+OpenCTI connector for importing threat intelligence feeds from SOCRadar platform.
 
 ## Description
 
-The SOCRadar connector fetches data from SOCRadar's threat intelligence feeds and imports them into OpenCTI. It supports:
-- IP addresses (IPv4 and IPv6)
-- Domains
-- URLs
-- File hashes (MD5, SHA1, SHA256)
-
-Each indicator is created with proper STIX2 formatting and includes:
-- Source attribution
-- First/last seen dates
-- Confidence levels
-- TLP marking
-- Kill chain phase information
-
-## Requirements
-
-- OpenCTI Platform >= 6.4.2
-- SOCRadar API key
-- Python 3.11+
+This connector imports threat intelligence data from SOCRadar into OpenCTI. It processes various types of indicators including:
+* IP addresses (IPv4 and IPv6)
+* Domain names
+* URLs
+* File hashes (MD5, SHA1, SHA256)
 
 ## Configuration
 
 | Parameter | Docker envvar | Mandatory | Description |
 | --- | --- | --- | --- |
-| `opencti_url` | `OPENCTI_URL` | Yes | The URL of the OpenCTI platform |
-| `opencti_token` | `OPENCTI_TOKEN` | Yes | The default admin token configured in the OpenCTI platform |
-| `connector_id` | `CONNECTOR_ID` | Yes | A valid arbitrary UUIDv4 for this connector |
-| `connector_type` | `CONNECTOR_TYPE` | Yes | Must be 'EXTERNAL_IMPORT' |
-| `connector_name` | `CONNECTOR_NAME` | Yes | Name of the connector |
-| `connector_scope` | `CONNECTOR_SCOPE` | Yes | Scope of the connector (socradar) |
-| `connector_confidence_level` | `CONNECTOR_CONFIDENCE_LEVEL` | Yes | Default confidence level for created data |
-| `connector_log_level` | `CONNECTOR_LOG_LEVEL` | Yes | Logging level (debug, info, warn, error) |
-| `radar_base_feed_url` | `RADAR_BASE_FEED_URL` | Yes | SocRadar API base URL |
-| `radar_format_type` | `RADAR_FORMAT_TYPE` | Yes | Response format (.json) |
-| `radar_socradar_key` | `RADAR_SOCRADAR_KEY` | Yes | Your SocRadar API key |
-| `radar_interval` | `RADAR_INTERVAL` | Yes | Interval between runs in seconds |
+| `opencti.url` | `OPENCTI_URL` | Yes | The URL of your OpenCTI platform |
+| `opencti.token` | `OPENCTI_TOKEN` | Yes | Your OpenCTI admin token |
+| `radar.radar_base_feed_url` | `RADAR_BASE_FEED_URL` | Yes | SOCRadar API base URL |
+| `radar.radar_socradar_key` | `RADAR_SOCRADAR_KEY` | Yes | Your SOCRadar API key |
+| `radar.radar_run_interval` | `RADAR_RUN_INTERVAL` | Yes | Time between runs (in seconds, default: 600) |
+| `radar.radar_collections_uuid` | `RADAR_COLLECTIONS_UUID` | Yes | Collection IDs to fetch |
+
+The `radar_collections_uuid` parameter should contain the collection IDs you want to fetch from SOCRadar. Example configuration:
+
+```yaml
+radar_collections_uuid:
+  collection_1:
+    id: ["YOUR_COLLECTION_ID"]
+    name: ["YOUR_COLLECTION_NAME"]
+  collection_2:
+    id: ["YOUR_COLLECTION_ID"]
+    name: ["YOUR_COLLECTION_NAME"]
+```
+
+## Installation
+
+1. Clone the repository:
+```bash
+git clone https://github.com/OpenCTI-Platform/connectors
+cd connectors/external-import/socradar
+```
+
+2. Configure the connector:
+```bash
+cp src/config.yml.sample src/config.yml
+```
+Edit `src/config.yml` with your OpenCTI and SOCRadar configurations.
+
+3. Add your connector to the `docker-compose.yml`:
+```yaml
+  connector-socradar:
+    build: ./external-import/socradar
+    container_name: docker-connector-socradar
+    environment:
+      - OPENCTI_URL=http://opencti:8080
+      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
+    restart: always
+    depends_on:
+      opencti:
+        condition: service_healthy
+```
+
+4. Start with Docker:
+```bash
+docker-compose up -d connector-socradar
+```
+
+You can check the connector status and logs in the OpenCTI platform UI or using:
+```bash
+docker-compose logs -f connector-socradar
+```

external-import/socradar/entrypoint.sh

@@ -8,4 +8,4 @@ ls -la /opt/opencti-connector-socradar/src
 
 # Directly execute python script
 cd /opt/opencti-connector-socradar
-python3 -v src/main.py
+python3 src/main.py

external-import/socradar/src/config.yml.sample

@@ -12,15 +12,13 @@ connector:
   update_existing_data: true
 
 radar:
-  base_feed_url: "https://platform.socradar.com/api/threat/intelligence/feed_list/"
-  format_type: ".json?key="
-  socradar_key: "SOCRADAR_KEY"
-  run_interval: 600
-  collections_uuid:
+  radar_base_feed_url: "https://platform.socradar.com/api/threat/intelligence/feed_list/"
+  radar_socradar_key: "SOCRADAR_KEY"
+  radar_run_interval: 600
+  radar_collections_uuid:
     collection_1:
       id: ["COLLECTION_UUID"]
       name: ["COLLECTION_NAME"]
-  default_marking: 'TLP:WHITE'
-  create_observables: true
-  create_indicators: true
-
+    collection_2:
+      id: ["COLLECTION_UUID"]
+      name: ["COLLECTION_NAME"]