Skip to content

fix(misp): preserve MISP threat-level severity semantics #169

Description

@seonghobae

Verified defect

Fresh review of the MISP adapter found a separate interoperability defect in src/misp_import.rs::severity_from_event. MISP's canonical threat_level_id semantics are 1 = High, 2 = Medium, 3 = Low, 4 = Undefined, while Wardnet's inherited translation mapped the defined levels one tier too strongly (1 -> Critical, 2 -> High, 3 -> Medium). That inflated source severity and could distort SOC evidence, alert prioritization, policy decisions and downstream provenance.

This is distinct from #168's to_ids/lifecycle admission repair and from #172's shared DNSBL snapshot ownership. It is an adapter/ACL translation defect: externally supplied source severity must not be silently promoted beyond the producer's asserted semantics.

TDD acceptance

RED:

  • otherwise admissible MISP events/attributes with threat_level_id 1, 2 and 3 must produce exactly Wardnet High, Medium and Low;
  • string and numeric source spellings accepted by the existing parser remain covered;
  • the inherited Critical/High/Medium behavior must fail those assertions.

GREEN:

Current owning candidate — 2026-09-06 KST

PR #170 is the bounded child owner at exact 7b383859257d2f317e0c40f68b3d8d706628ad9d, Draft. RED 45c5c2d0fc87cf6897eabaed032231fb589185e8 captured the inflated mapping before production change; GREEN 1502edf1cff801b1e4d31dfab1d4a0aad89ef489 implements 1 -> High, 2 -> Medium, 3 -> Low; subsequent documentation/tests retain compatibility behavior for 4 = Undefined, missing and unrecognized values.

The child last non-force adopted parent #167 through exact 28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98 by an ordinary two-parent merge. Its unique severity delta remains only src/misp_import.rs, tests/misp_threat_level_severity.rs, and docs/doctoring/misp-threat-level-severity.md; no shared DNSBL reconciliation implementation is duplicated.

Live parent #167 has since advanced linearly to 340f20b1898099bbf2b58a2a2cbd34c8f6057b35 with a one-line correction to the predecessor-state DNSBL ownership RED. GitHub therefore correctly reports #170 non-mergeable against its recorded parent. Do not churn/restack #170 solely for that transient parent test correction while #167 still lacks the shared DNSBL production GREEN. Once #167 reaches its causal shared-reconciler GREEN on a stable exact head, re-read every intervening parent delta and non-force adopt the complete parent lineage in one repair, then reacquire all child exact-head evidence. No parent RED/check/review evidence transfers.

Keep #170 Draft until #167/#172's shared production reconciliation reaches causal GREEN and #167 becomes protected truth or is fully superseded. Then non-force adopt fresh protected ancestry and reacquire every exact-current CI/Fuzz/security/SAST/CodeQL/review/governance gate. No predecessor evidence transfer, self/model approval, routine bypass, force push, destructive rebase, gate weakening or no-op redispatch churn.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions