fix(flowtriq): address review feedback

- Remove unused `confidence` variable (flake8 F841)
- Break long line in source IP extraction for Black compliance
- Persist `last_incident_time` in connector state so deduplication
  works across runs
- Add `severity` parameter to `get_incidents()` so callers can
  request a specific severity value
- Iterate all configured severities in `get_all_incidents()` instead
  of silently dropping all but the first

Author: FlyingDove2493

external-import/flowtriq/src/external_import_connector/client_api.py

@@ -27,7 +27,9 @@ def __init__(self, helper: "OpenCTIConnectorHelper", config: "ConnectorSettings"
             }
         )
 
-    def get_incidents(self, limit: int = 50, offset: int = 0) -> dict | None:
+    def get_incidents(
+        self, limit: int = 50, offset: int = 0, severity: str | None = None
+    ) -> dict | None:
         """
         Fetch incidents from the Flowtriq API.
 
@@ -43,10 +45,9 @@ def get_incidents(self, limit: int = 50, offset: int = 0) -> dict | None:
         if self.config.flowtriq.incident_status:
             params["status"] = self.config.flowtriq.incident_status
 
-        if self.config.flowtriq.incident_severity:
-            # API accepts a single severity filter; if multiple are configured,
-            # we make separate calls per severity in the connector layer.
-            # Here we pass the first one if set.
+        if severity:
+            params["severity"] = severity
+        elif self.config.flowtriq.incident_severity:
             params["severity"] = self.config.flowtriq.incident_severity[0]
 
         try:
@@ -86,29 +87,52 @@ def get_incident_detail(self, incident_uuid: str) -> dict | None:
             )
             return None
 
-    def get_all_incidents(self, max_total: int = 100) -> list[dict]:
-        """
-        Paginate through incidents up to max_total.
-        Returns a flat list of incident dicts.
-        """
-        all_incidents: list[dict] = []
+    def _paginate_incidents(
+        self, max_total: int, severity: str | None = None
+    ) -> list[dict]:
+        """Paginate through incidents for a single severity filter."""
+        results: list[dict] = []
         offset = 0
         page_size = min(max_total, 100)
 
         while offset < max_total:
-            data = self.get_incidents(limit=page_size, offset=offset)
+            data = self.get_incidents(
+                limit=page_size, offset=offset, severity=severity
+            )
             if not data or "incidents" not in data:
                 break
 
             incidents = data["incidents"]
             if not incidents:
                 break
 
-            all_incidents.extend(incidents)
+            results.extend(incidents)
             offset += len(incidents)
 
-            # Stop if we got fewer than requested (last page)
             if len(incidents) < page_size:
                 break
 
-        return all_incidents[:max_total]
+        return results[:max_total]
+
+    def get_all_incidents(self, max_total: int = 100) -> list[dict]:
+        """
+        Paginate through incidents up to max_total.
+        If multiple severities are configured, fetches each separately
+        and merges the results.
+        Returns a flat list of incident dicts.
+        """
+        severities = self.config.flowtriq.incident_severity
+        if severities and len(severities) > 1:
+            all_incidents: list[dict] = []
+            seen_uuids: set[str] = set()
+            per_severity_limit = max(max_total // len(severities), 10)
+            for sev in severities:
+                incidents = self._paginate_incidents(per_severity_limit, sev)
+                for inc in incidents:
+                    uid = inc.get("uuid", "")
+                    if uid and uid not in seen_uuids:
+                        seen_uuids.add(uid)
+                        all_incidents.append(inc)
+            return all_incidents[:max_total]
+
+        return self._paginate_incidents(max_total)

external-import/flowtriq/src/external_import_connector/connector.py

@@ -100,6 +100,7 @@ def _collect_intelligence(self) -> list:
         processed = 0
         skipped_severity = 0
         skipped_seen = 0
+        newest_incident_time = last_incident_time
 
         for incident in incidents:
             severity = incident.get("severity", "medium")
@@ -135,6 +136,17 @@ def _collect_intelligence(self) -> list:
                 stix_objects.extend(objects)
                 processed += 1
 
+                # Track the newest incident timestamp for dedup state
+                if started_at:
+                    if not newest_incident_time or started_at > newest_incident_time:
+                        newest_incident_time = started_at
+
+        # Persist the newest incident timestamp for next run deduplication
+        if newest_incident_time and newest_incident_time != last_incident_time:
+            state = self.helper.get_state() or {}
+            state["last_incident_time"] = newest_incident_time
+            self.helper.set_state(state)
+
         self.helper.connector_logger.info(
             "[CONNECTOR] Incident processing summary",
             {

external-import/flowtriq/src/external_import_connector/converter_to_stix.py

@@ -171,7 +171,6 @@ def create_incident_observable(
         peak_bps = incident.get("peak_bps", 0)
         started_at = incident.get("started_at")
         ended_at = incident.get("ended_at")
-        confidence = incident.get("confidence")
         incident_uuid = incident.get("uuid", "")
 
         if not target_ip:
@@ -295,7 +294,9 @@ def create_incident_observable(
         top_sources = incident.get("sp_top_sources")
         if top_sources and isinstance(top_sources, list):
             for source in top_sources:
-                source_ip = source.get("ip") if isinstance(source, dict) else str(source)
+                source_ip = (
+                    source.get("ip") if isinstance(source, dict) else str(source)
+                )
                 if not source_ip:
                     continue