Add MISP Sharing Pipeline Engine

Summary

This PR implements a new CoreTIDE engine that publishes OpenTIDE objects (TVM, DOM, MDR) as MISP events to one or more configured MISP instances. The pipeline follows the established CoreTIDE engine pattern and integrates with existing CI workflows.

Features

• TLP-Based Sharing Scope: Objects are filtered per MISP instance based on max_allowed_tlp configuration. Supports full TLP hierarchy (clear/white, green, amber, amber+strict, red) with case-insensitive parsing.

• Version Control: Compares local object version against remote MISP event version. Creates new events when none exist, updates when local > remote, skips when versions are current.

• Deterministic Event UUIDs: MISP event UUIDs are derived deterministically from OpenTIDE object UUIDs using UUID5 namespacing, ensuring consistent event identity across instances.

• Relation Resolution:

  • TVM: Recursive chaining resolution via DataTide.Models.chaining with cycle protection
  • DOM: Direct reference to objective.threats UUIDs
  • MDR: Single detection_model UUID reference

• MISP Event Tagging:

  • TLP tags in MISP taxonomy format (tlp:green, etc.)
  • ATT&CK technique tags via techniques_resolver()
  • Threat actor galaxy clusters with priority logic (MISP-stage > ATT&CK-stage)

• CI Integration: Supports GitHub Actions, GitLab CI, and Azure Pipelines. Skips on PR/MR events, executes on default branch push and LocalDebug mode.

• Fail-Forward Error Handling: Connection failures to one MISP instance don't halt processing of others. API errors on individual objects are logged and processing continues.

Components Added

Configuration

The pipeline reads from sharing.toml:

[organisation]
enabled = true
name = "My Organisation"
uuid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

[[misp]]
name = "Internal MISP"
url = "https://misp.internal.org"
token = "$MISP_INTERNAL_TOKEN"  # Resolved from env var
org_uuid = "11111111-2222-3333-4444-555555555555"
max_allowed_tlp = "amber"
mode = "send"
proxy = false
publish_on_change = true
verify_ssl = true

Testing

• 103 tests covering all requirements
• Property-based tests using Hypothesis for:
  • TLP hierarchy ordering
  • Configuration parsing/validation
  • Scope filtering correctness
  • Version comparison logic
  • TVM chaining resolution
  • MISP object attribute completeness
  • Tag format correctness

• Unit tests with mocked PyMISP for API interactions
• Integration tests for end-to-end flow

Requirements Covered
All 9 requirement groups from the spec:

1. Sharing Configuration Schema
2. TLP-Based Sharing Scope
3. MISP Event Existence Check
4. Version Comparison and Update Decision
5. MISP Event Creation and Structure
6. MISP Event Tagging
7. CI Pipeline Integration
8. Error Handling and Logging
9. SSL and Network Configuration

Dependencies

• pymisp added to requirements.txt

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}