{"owner":"OpenCTI-Platform","repo":"opencti","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":[".github/copilot-instructions.md"],"skills":{".github/copilot-instructions.md":"# OpenCTI Project Instructions\n\n> **Deep-dive references** — read the relevant doc before touching the related code:\n> - [Backend Architecture (opencti-graphql)](instructions/backend.instructions.md)\n> - [Frontend Architecture (opencti-front)](instructions/frontend.instructions.md)\n> - [Python Client & Worker](instructions/python.instructions.md)\n> - [Documentation Authoring (docs)](instructions/docs.instructions.md)\n> - [Code Review Guidelines](instructions/code-review.instructions.md)\n\n> **Copilot Skills** (`.github/skills/`) — procedural playbooks, load the relevant one before starting the task:\n> - `create-module` — Scaffold a new backend domain module (entity type, schema, resolvers, converter)\n> - `create-migration` — Create a new ElasticSearch database migration file\n> - `create-react-component` — Create a new Relay-connected React component\n> - `create-creation-form` — Scaffold a creation form drawer (Formik + Relay mutation)\n> - `create-playbook-component` — Add a new playbook automation component\n> - `create-workflow` — Scaffold a new GitHub Actions workflow\n\n## Project Overview\n\nOpenCTI is a cyber threat intelligence platform built with a **monorepo structure** containing:\n- **opencti-platform/opencti-graphql**: Node.js/TypeScript GraphQL API backend\n- **opencti-platform/opencti-front**: React/TypeScript frontend with Relay\n- **client-python**: Python library (pycti) for API access\n- **opencti-worker**: Python worker for background tasks\n- **docs**: MkDocs documentation\n\n## Global Commands & Setup\n\n### 1. Enable Corepack (first-time only)\nOnly needed if Yarn is not already available. Run once per machine:\n```bash\ncorepack enable\n```\nDo **not** add this before every command — assume a dev environment already has corepack enabled.\n\n### 2. Copy .yarnrc.yml (first install only)\nOnly needed when running `yarn install` for the first time in a subdirectory that does not already have `.yarnrc.yml`:\n\n```bash\n# Example for backend\ncd opencti-platform/opencti-graphql\ncp ../.yarnrc.yml .yarnrc.yml\nyarn install\n```\n\nDo **not** copy `.yarnrc.yml` before running tests or other commands — it only matters for `yarn install`.\n\n### 3. Root NX Commands (run from repo root)\nThe root `package.json` uses **NX** to orchestrate all workspaces at once. Prefer these over manually running commands in each subdirectory:\n\n```bash\n# Install all dependencies (frontend + backend + Python)\nyarn deps          # without Python virtualenv\nyarn deps:venv     # with Python virtualenv (recommended)\n\n# Start all dev servers\nyarn dev           # without Python virtualenv\nyarn dev:venv      # with Python virtualenv\n\n# Build everything\nyarn build         # without Python virtualenv\nyarn build:venv    # with Python virtualenv\n\n# Run all tests\nyarn test          # without Python virtualenv\nyarn test:venv     # with Python virtualenv\n\n# Lint everything\nyarn lint\n\n# Regenerate GraphQL schema across all packages\nyarn graphql\n```\n\nThe `:venv` variants wrap the command with a Python virtual environment — use them when working on `client-python` or `opencti-worker` and running the backend app.\n\n### 4. Local Development Stack\nStart the necessary infrastructure (Elastic, Redis, RabbitMQ, MinIO):\n```bash\ncd opencti-platform/opencti-dev\ndocker compose up -d\n```\n**(ElasticSearch requires `vm.max_map_count=262144`)**\n\n## Common Pitfalls\n\n- **Yarn install fails**: Is `.yarnrc.yml` present in the subdirectory? Run `cp ../.yarnrc.yml .yarnrc.yml` then retry.\n- **Yarn not found**: Run `corepack enable` once.\n- **Python Dependencies**: Backend requires `yarn install:python`.\n- **Relay**: Frontend requires `yarn relay` after any GraphQL changes.\n- **Node Memory**: Use `NODE_OPTIONS=--max_old_space_size=8192` for large builds.\n\n## Safety Rules\n\n### Destructive Git & File Operations\n**NEVER** run any operation that could cause loss of uncommitted work without explicit user approval. This includes:\n- `git reset --hard`, `git checkout -- <file>`, `git clean -fd`\n- `git stash drop`, `git rebase`, `git push --force`\n- Deleting or overwriting files that may contain unsaved changes\n\n**Before** running any such command:\n1. Run `git status` and `git diff` to identify uncommitted or unstaged changes.\n2. Present a **clear, plain-language summary** of exactly what would be lost (e.g. \"This will discard your unsaved changes to `src/foo.ts` and `src/bar.ts`\").\n3. **Wait for explicit approval** before proceeding.\n\n<!-- filigran-conventions:start -->\n## Commit, PR & issue conventions\n\nAll commits, pull requests and issues in this repository follow the\n[Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)\nspecification with a GitHub issue reference:\n\n```\ntype(scope?)!?: description (#issue)\n```\n\n- Types: `feat`, `fix`, `chore`, `docs`, `style`, `refactor`, `perf`, `test`,\n  `build`, `ci`, `revert`.\n- The description starts with a lowercase letter and has no trailing period;\n  preserve acronyms and proper nouns.\n- The old `[backend]` / `[frontend]` bracket prefixes are discontinued — use a\n  Conventional Commits scope instead.\n- Pull request titles **must** end with the related issue reference, e.g.\n  `(#1234)`, and every pull request must be linked to an issue.\n- Sign your commits.\n\nWhen generating commit messages, PR titles or issue titles, always follow this\nconvention. See [`.github/LABELS.md`](.github/LABELS.md) for the full title and\nlabel taxonomy.\n<!-- filigran-conventions:end -->\n\n\n<!-- filigran-model-policy:start -->\n## GitHub Copilot model usage\n\nTo keep token consumption under control, pick the model that matches the task:\n\n- **Opus 4.6** — reserve for complex work: deep reasoning, large refactors,\n  architecture design, tricky debugging. It is significantly more\n  token-expensive, so it is not the daily driver.\n- **Sonnet / Gemini / GPT** — default for everyday tasks: autocomplete, small\n  fixes, quick questions, code explanations.\n\nWe have a limited token budget — being mindful of the model you pick makes a\nreal difference at scale. Think of Opus as a specialist you call in when you\nreally need it.\n<!-- filigran-model-policy:end -->\n"},"files":{".github/copilot-instructions.md":"# OpenCTI Project Instructions\n\n> **Deep-dive references** — read the relevant doc before touching the related code:\n> - [Backend Architecture (opencti-graphql)](instructions/backend.instructions.md)\n> - [Frontend Architecture (opencti-front)](instructions/frontend.instructions.md)\n> - [Python Client & Worker](instructions/python.instructions.md)\n> - [Documentation Authoring (docs)](instructions/docs.instructions.md)\n> - [Code Review Guidelines](instructions/code-review.instructions.md)\n\n> **Copilot Skills** (`.github/skills/`) — procedural playbooks, load the relevant one before starting the task:\n> - `create-module` — Scaffold a new backend domain module (entity type, schema, resolvers, converter)\n> - `create-migration` — Create a new ElasticSearch database migration file\n> - `create-react-component` — Create a new Relay-connected React component\n> - `create-creation-form` — Scaffold a creation form drawer (Formik + Relay mutation)\n> - `create-playbook-component` — Add a new playbook automation component\n> - `create-workflow` — Scaffold a new GitHub Actions workflow\n\n## Project Overview\n\nOpenCTI is a cyber threat intelligence platform built with a **monorepo structure** containing:\n- **opencti-platform/opencti-graphql**: Node.js/TypeScript GraphQL API backend\n- **opencti-platform/opencti-front**: React/TypeScript frontend with Relay\n- **client-python**: Python library (pycti) for API access\n- **opencti-worker**: Python worker for background tasks\n- **docs**: MkDocs documentation\n\n## Global Commands & Setup\n\n### 1. Enable Corepack (first-time only)\nOnly needed if Yarn is not already available. Run once per machine:\n```bash\ncorepack enable\n```\nDo **not** add this before every command — assume a dev environment already has corepack enabled.\n\n### 2. Copy .yarnrc.yml (first install only)\nOnly needed when running `yarn install` for the first time in a subdirectory that does not already have `.yarnrc.yml`:\n\n```bash\n# Example for backend\ncd opencti-platform/opencti-graphql\ncp ../.yarnrc.yml .yarnrc.yml\nyarn install\n```\n\nDo **not** copy `.yarnrc.yml` before running tests or other commands — it only matters for `yarn install`.\n\n### 3. Root NX Commands (run from repo root)\nThe root `package.json` uses **NX** to orchestrate all workspaces at once. Prefer these over manually running commands in each subdirectory:\n\n```bash\n# Install all dependencies (frontend + backend + Python)\nyarn deps          # without Python virtualenv\nyarn deps:venv     # with Python virtualenv (recommended)\n\n# Start all dev servers\nyarn dev           # without Python virtualenv\nyarn dev:venv      # with Python virtualenv\n\n# Build everything\nyarn build         # without Python virtualenv\nyarn build:venv    # with Python virtualenv\n\n# Run all tests\nyarn test          # without Python virtualenv\nyarn test:venv     # with Python virtualenv\n\n# Lint everything\nyarn lint\n\n# Regenerate GraphQL schema across all packages\nyarn graphql\n```\n\nThe `:venv` variants wrap the command with a Python virtual environment — use them when working on `client-python` or `opencti-worker` and running the backend app.\n\n### 4. Local Development Stack\nStart the necessary infrastructure (Elastic, Redis, RabbitMQ, MinIO):\n```bash\ncd opencti-platform/opencti-dev\ndocker compose up -d\n```\n**(ElasticSearch requires `vm.max_map_count=262144`)**\n\n## Common Pitfalls\n\n- **Yarn install fails**: Is `.yarnrc.yml` present in the subdirectory? Run `cp ../.yarnrc.yml .yarnrc.yml` then retry.\n- **Yarn not found**: Run `corepack enable` once.\n- **Python Dependencies**: Backend requires `yarn install:python`.\n- **Relay**: Frontend requires `yarn relay` after any GraphQL changes.\n- **Node Memory**: Use `NODE_OPTIONS=--max_old_space_size=8192` for large builds.\n\n## Safety Rules\n\n### Destructive Git & File Operations\n**NEVER** run any operation that could cause loss of uncommitted work without explicit user approval. This includes:\n- `git reset --hard`, `git checkout -- <file>`, `git clean -fd`\n- `git stash drop`, `git rebase`, `git push --force`\n- Deleting or overwriting files that may contain unsaved changes\n\n**Before** running any such command:\n1. Run `git status` and `git diff` to identify uncommitted or unstaged changes.\n2. Present a **clear, plain-language summary** of exactly what would be lost (e.g. \"This will discard your unsaved changes to `src/foo.ts` and `src/bar.ts`\").\n3. **Wait for explicit approval** before proceeding.\n\n<!-- filigran-conventions:start -->\n## Commit, PR & issue conventions\n\nAll commits, pull requests and issues in this repository follow the\n[Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)\nspecification with a GitHub issue reference:\n\n```\ntype(scope?)!?: description (#issue)\n```\n\n- Types: `feat`, `fix`, `chore`, `docs`, `style`, `refactor`, `perf`, `test`,\n  `build`, `ci`, `revert`.\n- The description starts with a lowercase letter and has no trailing period;\n  preserve acronyms and proper nouns.\n- The old `[backend]` / `[frontend]` bracket prefixes are discontinued — use a\n  Conventional Commits scope instead.\n- Pull request titles **must** end with the related issue reference, e.g.\n  `(#1234)`, and every pull request must be linked to an issue.\n- Sign your commits.\n\nWhen generating commit messages, PR titles or issue titles, always follow this\nconvention. See [`.github/LABELS.md`](.github/LABELS.md) for the full title and\nlabel taxonomy.\n<!-- filigran-conventions:end -->\n\n\n<!-- filigran-model-policy:start -->\n## GitHub Copilot model usage\n\nTo keep token consumption under control, pick the model that matches the task:\n\n- **Opus 4.6** — reserve for complex work: deep reasoning, large refactors,\n  architecture design, tricky debugging. It is significantly more\n  token-expensive, so it is not the daily driver.\n- **Sonnet / Gemini / GPT** — default for everyday tasks: autocomplete, small\n  fixes, quick questions, code explanations.\n\nWe have a limited token budget — being mindful of the model you pick makes a\nreal difference at scale. Think of Opus as a specialist you call in when you\nreally need it.\n<!-- filigran-model-policy:end -->\n"},"items":[{"name":"copilot-instructions.md","path":".github/copilot-instructions.md","title":"copilot-instructions.md","content":"# OpenCTI Project Instructions\n\n> **Deep-dive references** — read the relevant doc before touching the related code:\n> - [Backend Architecture (opencti-graphql)](instructions/backend.instructions.md)\n> - [Frontend Architecture (opencti-front)](instructions/frontend.instructions.md)\n> - [Python Client & Worker](instructions/python.instructions.md)\n> - [Documentation Authoring (docs)](instructions/docs.instructions.md)\n> - [Code Review Guidelines](instructions/code-review.instructions.md)\n\n> **Copilot Skills** (`.github/skills/`) — procedural playbooks, load the relevant one before starting the task:\n> - `create-module` — Scaffold a new backend domain module (entity type, schema, resolvers, converter)\n> - `create-migration` — Create a new ElasticSearch database migration file\n> - `create-react-component` — Create a new Relay-connected React component\n> - `create-creation-form` — Scaffold a creation form drawer (Formik + Relay mutation)\n> - `create-playbook-component` — Add a new playbook automation component\n> - `create-workflow` — Scaffold a new GitHub Actions workflow\n\n## Project Overview\n\nOpenCTI is a cyber threat intelligence platform built with a **monorepo structure** containing:\n- **opencti-platform/opencti-graphql**: Node.js/TypeScript GraphQL API backend\n- **opencti-platform/opencti-front**: React/TypeScript frontend with Relay\n- **client-python**: Python library (pycti) for API access\n- **opencti-worker**: Python worker for background tasks\n- **docs**: MkDocs documentation\n\n## Global Commands & Setup\n\n### 1. Enable Corepack (first-time only)\nOnly needed if Yarn is not already available. Run once per machine:\n```bash\ncorepack enable\n```\nDo **not** add this before every command — assume a dev environment already has corepack enabled.\n\n### 2. Copy .yarnrc.yml (first install only)\nOnly needed when running `yarn install` for the first time in a subdirectory that does not already have `.yarnrc.yml`:\n\n```bash\n# Example for backend\ncd opencti-platform/opencti-graphql\ncp ../.yarnrc.yml .yarnrc.yml\nyarn install\n```\n\nDo **not** copy `.yarnrc.yml` before running tests or other commands — it only matters for `yarn install`.\n\n### 3. Root NX Commands (run from repo root)\nThe root `package.json` uses **NX** to orchestrate all workspaces at once. Prefer these over manually running commands in each subdirectory:\n\n```bash\n# Install all dependencies (frontend + backend + Python)\nyarn deps          # without Python virtualenv\nyarn deps:venv     # with Python virtualenv (recommended)\n\n# Start all dev servers\nyarn dev           # without Python virtualenv\nyarn dev:venv      # with Python virtualenv\n\n# Build everything\nyarn build         # without Python virtualenv\nyarn build:venv    # with Python virtualenv\n\n# Run all tests\nyarn test          # without Python virtualenv\nyarn test:venv     # with Python virtualenv\n\n# Lint everything\nyarn lint\n\n# Regenerate GraphQL schema across all packages\nyarn graphql\n```\n\nThe `:venv` variants wrap the command with a Python virtual environment — use them when working on `client-python` or `opencti-worker` and running the backend app.\n\n### 4. Local Development Stack\nStart the necessary infrastructure (Elastic, Redis, RabbitMQ, MinIO):\n```bash\ncd opencti-platform/opencti-dev\ndocker compose up -d\n```\n**(ElasticSearch requires `vm.max_map_count=262144`)**\n\n## Common Pitfalls\n\n- **Yarn install fails**: Is `.yarnrc.yml` present in the subdirectory? Run `cp ../.yarnrc.yml .yarnrc.yml` then retry.\n- **Yarn not found**: Run `corepack enable` once.\n- **Python Dependencies**: Backend requires `yarn install:python`.\n- **Relay**: Frontend requires `yarn relay` after any GraphQL changes.\n- **Node Memory**: Use `NODE_OPTIONS=--max_old_space_size=8192` for large builds.\n\n## Safety Rules\n\n### Destructive Git & File Operations\n**NEVER** run any operation that could cause loss of uncommitted work without explicit user approval. This includes:\n- `git reset --hard`, `git checkout -- <file>`, `git clean -fd`\n- `git stash drop`, `git rebase`, `git push --force`\n- Deleting or overwriting files that may contain unsaved changes\n\n**Before** running any such command:\n1. Run `git status` and `git diff` to identify uncommitted or unstaged changes.\n2. Present a **clear, plain-language summary** of exactly what would be lost (e.g. \"This will discard your unsaved changes to `src/foo.ts` and `src/bar.ts`\").\n3. **Wait for explicit approval** before proceeding.\n\n<!-- filigran-conventions:start -->\n## Commit, PR & issue conventions\n\nAll commits, pull requests and issues in this repository follow the\n[Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)\nspecification with a GitHub issue reference:\n\n```\ntype(scope?)!?: description (#issue)\n```\n\n- Types: `feat`, `fix`, `chore`, `docs`, `style`, `refactor`, `perf`, `test`,\n  `build`, `ci`, `revert`.\n- The description starts with a lowercase letter and has no trailing period;\n  preserve acronyms and proper nouns.\n- The old `[backend]` / `[frontend]` bracket prefixes are discontinued — use a\n  Conventional Commits scope instead.\n- Pull request titles **must** end with the related issue reference, e.g.\n  `(#1234)`, and every pull request must be linked to an issue.\n- Sign your commits.\n\nWhen generating commit messages, PR titles or issue titles, always follow this\nconvention. See [`.github/LABELS.md`](.github/LABELS.md) for the full title and\nlabel taxonomy.\n<!-- filigran-conventions:end -->\n\n\n<!-- filigran-model-policy:start -->\n## GitHub Copilot model usage\n\nTo keep token consumption under control, pick the model that matches the task:\n\n- **Opus 4.6** — reserve for complex work: deep reasoning, large refactors,\n  architecture design, tricky debugging. It is significantly more\n  token-expensive, so it is not the daily driver.\n- **Sonnet / Gemini / GPT** — default for everyday tasks: autocomplete, small\n  fixes, quick questions, code explanations.\n\nWe have a limited token budget — being mindful of the model you pick makes a\nreal difference at scale. Think of Opus as a specialist you call in when you\nreally need it.\n<!-- filigran-model-policy:end -->\n","category":".github","tokens":1527}]}