APPSINTG-406:Intel 471 verity document - #7143
Conversation
amee-sumo
left a comment
There was a problem hiding this comment.
Left an inline comment on the Actions section, and the main scope/duplication concern below.
This looks like an incomplete or wrong implementation of its own ticket, not just a docs nit.
The linked Jira ticket (APPSINTG-406) frames this as migrating the existing Intel 471 integration to the Verity API, and lists three actions needing their endpoints updated: Stream Malware Intelligence Indicators -> /v1/indicators/stream, Search IOC -> /v1/iocs, and List Alerts -> /v1/alerts. This PR only implements the first one, and does it as a brand-new, separate doc (intel-471-verity.md) rather than updating the existing intel-471.md in place.
A few things point to this being a mistake rather than intentional:
- A prior PR (#7124, same author, same ticket) already attempted an in-place migration of
intel-471.mdto Verity (updating auth, URL, changelog) but was closed without merging. This PR appears to restart the work as a parallel file instead, with no explanation for the change in direction. docs/platform-services/automation-service/app-central/integrations/uses an autogenerated sidebar category, so if this merges as-is, customers will see both "Intel 471" and "Intel 471 Verity" as separate catalog entries under confusingly similar names, one still on the old username/password + API key auth.- The old
intel-471.mdis left completely untouched, still describing the old auth flow as current.
If Intel 471 Verity is genuinely meant to be a distinct, separate integration from the original (not a replacement), that's a reasonable design, but nothing in the PR description says so, and the ticket's own framing reads as an in-place upgrade rather than a new parallel product.
Could you confirm: does this replace intel-471.md, or are both meant to coexist? And is the plan to add Search IOC and List Alerts here or elsewhere?
Mechanically the doc itself is clean — structure, config steps, and Change Log format all match sibling conventions, and CI is green.
Intel 471 Verity is a threat intelligence platform that delivers streaming malware and indicator intelligence through the Verity API. It uses Client ID and Client Secret authentication to provide access to real-time indicator streams for threat detection and response.
Select the type of change
Ticket (if applicable)
https://sumologic.atlassian.net/browse/APPSINTG-406