OTX pulse enrichment helpers and indicator-match rule

[arielkr256]

Summary

• Add panther_otx_helpers global helper exposing the full OTX.Pulses schema (pulse metadata, indicator metadata, severity derivation, alert context).
• Add Standard.OTX.MaliciousIndicator rule that matches enriched IOCs across IPs, domains, file hashes (MD5/SHA1/SHA256), and emails against the *_otx lookup table, with severity escalated when the matching pulse names an adversary or known malware family.
• Add two saved queries under queries/otx_queries/ that group the per-indicator OTX pulse rows back into per-pulse rollups:
  • Query.OTX.PulsesSummary — recent pulses with indicator-type breakdown (IP / domain / hash / URL / email / CVE).
  • Query.OTX.HighImpactPulses — pulses with a named adversary or malware family, scored CRITICAL / HIGH.

Testing

make test

THREAT-589 THREAT-590

[cursor]

PR Summary

Medium Risk
Adds a new cross-logtype detection rule driven by OTX lookup-table enrichment and changes shared severity-comparison logic, which can impact alerting behavior and severity calculation across rules.

Overview
Adds AlienVault OTX pulse enrichment support via new panther_otx_helpers, including LUT auto-detection, parsed pulse/indicator accessors, severity derivation (otx_severity*), and alert-context builders.

Introduces a new standard rule Standard.OTX.MaliciousIndicator that matches enriched IOCs (IPs/domains/hashes/emails) in p_any_* fields and sets alert severity based on pulse metadata; adds two saved queries to summarize/highlight high-impact OTX pulses.

Refactors severity comparison into panther_base_helpers.severity_greater_than (re-exported from GreyNoise/OTX helpers for compatibility) and tweaks GreyNoise rule severity selection to handle None initial state; updates detection-coverage/index docs to include the new OTX rule.

^{Reviewed by Cursor Bugbot for commit 1f8da89. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

LUT detection fails when all indicators have multiple matches

Medium Severity

_find_otx_lut_name only recognizes single-match enrichment entries (dicts) via hasattr(match_data, "get"). When an indicator appears in multiple OTX pulses, the enrichment stores a list of dicts for that indicator. Lists lack a get method, so the check silently skips them. If every indicator in the event has multiple pulse matches, the function returns None, causing get_otx_object to return None and the rule to miss the threat entirely. The rest of the code (_lookup, otx_severity zip logic) explicitly handles multi-match lists, confirming this scenario is intended to work.

 

^{Reviewed by Cursor Bugbot for commit a6b62c3. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0ffb30a. Configure here.}