Exclude analyst false positives from clustering anchors - #45
Merged
Conversation
An IOC an analyst marked false_positive no longer exports, but it kept acting as a clustering anchor: a benign or mis-extracted identifier (e.g. a legitimate vendor IBAN) could keep merging unrelated conversations into one threat-actor cluster — wrong attribution outliving the bad extraction. The anchor selection now skips indicators with a false_positive verdict; a confirmed verdict keeps clustering unchanged (covered by a control test). Already-formed clusters are not retroactively split; the next re-clustering pass rebuilds without the excluded anchor.
There was a problem hiding this comment.
Pull request overview
This PR updates clustering semantics so an analyst false_positive verdict prevents an IOC from being used as a clustering merge anchor, avoiding incorrect threat-actor attribution caused by benign/mis-extracted identifiers. It adds an integration test that demonstrates the prior merge behavior (red-first) and a confirmed-verdict control test.
Changes:
- Exclude IOCs with analyst verdict
false_positivefrom the anchor set used to find shared conversations during clustering. - Add integration coverage ensuring
false_positivedoes not merge conversations whileconfirmedstill does.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| backend-symfony/src/Application/Clustering/IocClusteringService.php | Filters out false_positive IOCs when deriving anchors for shared-conversation discovery. |
| backend-symfony/tests/Integration/Clustering/FalsePositiveAnchorTest.php | Adds integration tests for false-positive and confirmed verdict effects on clustering merges. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
laugiov
added a commit
that referenced
this pull request
Aug 10, 2026
Review follow-up to #45: the filter covered merge-edge discovery but not getAnchorIocsForConversation(), so a cluster formed through a valid anchor still persisted the false-positive IOC in its anchor metadata. Covered by a two-anchor test proving the valid anchor still clusters while the false positive stays out of threat_actor_cluster_ioc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An analyst false_positive verdict now removes an IOC from the clustering anchor set, completing its semantics: no export (#43), no UI selection (#44), and no longer merging unrelated conversations into one actor cluster. Red-first test proving the old merge behavior, plus a confirmed-verdict control test; 21 clustering tests green, full suite at known baseline, PHPStan L8 + cs-fixer clean.