[Hatching Triage Sandbox] URL analysis support + Playbook compatibility

[helene-nguyen]

Proposed changes

• Add playbook compatibility and handle bundle when STIX objects is not in scope defined
• URL analysis submission support
• Remove confidence_level inf configuration files as it is not used anymore since OpenCTI version >= 6.0.0

Related issues

• [Hatching Triage] URL analysis support + Playbook compatibility #2931

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[Megafredo]

I noticed 3 small points, they are side effects but no problems with your code, great job !

01 - The first point is that the urls are accepted and sometimes we find some with ‘?’, which results in a 400 INVALID QUERY error from the sorting client.

02 - We need to update the relationship_type a little if the entity_type is a url.

for ttp in ttps:
    attack_pattern = stix2.AttackPattern(
        id=AttackPattern.generate_id(name, ttp),
        created_by_ref=self.identity,
        name=name,
        custom_properties={
            "x_mitre_id": ttp,
        },
        object_marking_refs=[stix2.TLP_WHITE],
        allow_custom=True,
    )

    <<<<<<<<<<<<<<<<<<<<<<<<
    relationship_type = ( 
        "uses" if entity_type == "artifact" else "related-to"
    )
    <<<<<<<<<<<<<<<<<<<<<<<<

    relationship = stix2.Relationship(
        id=StixCoreRelationship.generate_id(
            relationship_type, observable["standard_id"], attack_pattern.id  <<<<<<<<<<
        ),
        relationship_type=relationship_type,
        created_by_ref=self.identity,
        source_ref=observable["standard_id"],
        target_ref=attack_pattern.id,
        object_marking_refs=[stix2.TLP_WHITE],
        allow_custom=True,
    )

03 - Add a little end message for the front end when it's a success ! xD

# Serialize and send all bundles
if bundle_objects:
    self._send_bundle(bundle_objects)
    return "Enrichment has been achieved."                         <<<<<<<<<<

[helene-nguyen]

@Megafredo Thanks a lot for your feedback ✨

For point 1, it will be added in the documentation, other points is corrected :)

[Megafredo]

It's ok for me ;), good job !