fix(arcsight-incidents): stable modified, redact errors, close responses

Address the remaining Copilot review plus an independent senior pass, and keep
the connector installable against current master:

- converter_to_stix.py: the Case-Incident `modified` now falls back to the
  already-stable `created` value (never "now") when the ArcSight modified
  timestamp is missing or unparseable, so the deterministic id is no longer
  re-sent with a drifting `modified` each run.
- connector.py: the top-level error handler no longer logs or forwards
  `str(err)` (the ESM auth flow carries the password/token in query parameters,
  which a requests exception string can embed); it logs the exception type via
  structured `meta` and sends a sanitized work message.
- arcsight_client/api_client.py: `_request` closes the HTTP response on the
  429/5xx-retry and non-retriable HTTPError paths so a periodic run does not
  keep connections checked out of the requests Session pool.
- src/requirements.txt: bump the pinned pycti to 7.260615.0 to match the current
  connectors-sdk; align the README minimum and the manifest support_version.

Author: SamuelHassine

external-import/arcsight-incidents/README.md

@@ -37,7 +37,7 @@ author identity and marked with a configurable TLP.
 
 ## Requirements
 
-- OpenCTI Platform >= 7.260609.0
+- OpenCTI Platform >= 7.260615.0
 - A reachable ArcSight ESM Manager (Service Layer REST API enabled)
 - An ESM account allowed to read cases
 

external-import/arcsight-incidents/__metadata__/connector_manifest.json

@@ -11,7 +11,7 @@
   "last_verified_date": null,
   "playbook_supported": false,
   "max_confidence_level": 50,
-  "support_version": ">=7.260609.0",
+  "support_version": ">=7.260615.0",
   "subscription_link": "https://www.opentext.com/products/arcsight-enterprise-security-manager",
   "source_code": "https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/arcsight-incidents",
   "manager_supported": true,

external-import/arcsight-incidents/src/arcsight_client/api_client.py

@@ -214,10 +214,14 @@ def _request(self, method: str, path: str, **kwargs) -> Optional[requests.Respon
                 continue
 
             if response.status_code == 429 or response.status_code >= 500:
+                status_code = response.status_code
+                # Release the connection back to the Session pool: the body is
+                # never consumed on this retry/error path.
+                response.close()
                 if last_attempt:
                     self.helper.connector_logger.warning(
                         "[API] ArcSight request failed",
-                        meta={"path": path, "status_code": response.status_code},
+                        meta={"path": path, "status_code": status_code},
                     )
                     return None
                 time.sleep(self.BACKOFF_FACTOR * (2**attempt))
@@ -234,6 +238,7 @@ def _request(self, method: str, path: str, **kwargs) -> Optional[requests.Respon
                         "error_type": type(err).__name__,
                     },
                 )
+                response.close()
                 return None
             return response
         return None

external-import/arcsight-incidents/src/connector/connector.py

@@ -75,9 +75,18 @@ def process_message(self) -> None:
             self.helper.connector_logger.info("[CONNECTOR] Connector stopped...")
             sys.exit(0)
         except Exception as err:
-            self.helper.connector_logger.error(str(err))
+            # Do not log or forward str(err): the ESM auth flow passes the
+            # password/token as query parameters and a requests exception string
+            # usually embeds the full request URL, so it could leak credentials.
+            self.helper.connector_logger.error(
+                "[CONNECTOR] Run failed", meta={"error_type": type(err).__name__}
+            )
             if work_id:
-                self.helper.api.work.to_processed(work_id, str(err), in_error=True)
+                self.helper.api.work.to_processed(
+                    work_id,
+                    f"ArcSight Incidents connector run failed: {type(err).__name__}",
+                    in_error=True,
+                )
 
     def run(self) -> None:
         self.helper.schedule_process(

external-import/arcsight-incidents/src/connector/converter_to_stix.py

@@ -232,9 +232,13 @@ def create_case_incident(
             if source_dt is not None
             else _FALLBACK_TIMESTAMP
         )
-        modified = self._to_iso(
-            case.get("modifiedTimestamp") or case.get("modifiedTime") or created
+        # Fall back to the already-stable created value (never "now") when the
+        # modified timestamp is missing or unparseable, so the deterministic
+        # Case-Incident id is not re-sent with a drifting modified each run.
+        modified_dt = self._parse_timestamp(
+            case.get("modifiedTimestamp") or case.get("modifiedTime")
         )
+        modified = self._format_iso(modified_dt) if modified_dt is not None else created
         severity = self._map_severity(
             case.get("consequenceSeverity", case.get("severity"))
         )

external-import/arcsight-incidents/src/requirements.txt

@@ -1,4 +1,4 @@
-pycti==7.260609.0
+pycti==7.260615.0
 pydantic~=2.11.3
 requests~=2.33.0
 stix2~=3.0.1

external-import/arcsight-incidents/tests/test_converter.py

@@ -179,3 +179,19 @@ def test_case_incident_timestamps_use_stable_fallback_without_timestamp():
     case = converter.create_case_incident({"name": "x", "resourceid": "A"})
     assert str(case["created"]).startswith("1970-01-01")
     assert str(case["modified"]).startswith("1970-01-01")
+
+
+def test_case_incident_modified_falls_back_to_created_when_unparseable():
+    # A non-empty but unparseable modified timestamp must fall back to the stable
+    # created value (not "now"), so the deterministic id is not re-sent with a
+    # drifting modified each run.
+    converter = _converter()
+    case = converter.create_case_incident(
+        {
+            "name": "x",
+            "resourceid": "A",
+            "createdTimestamp": 1700000000000,
+            "modifiedTimestamp": "not-a-timestamp",
+        }
+    )
+    assert case["modified"] == case["created"]