[ctm360] Avoid empty breached-credential Indicator pattern

In breached_credentials_to_stix, `indicator_value = email or username` is truthy when an email is present but invalid (no "@") and the username is empty. The else-branch then built the user-account pattern/name from the empty username, producing `[user-account:account_login = '']` — an empty, constant pattern that collapses unrelated records onto a single `Indicator.generate_id(pattern)` id and breaks ingestion expectations.

Fall back to `username or email` for the account-login pattern and name (mirroring the UserAccount `account_login` already built above), so the pattern is never empty when an Indicator is created. Add regression tests asserting the non-empty pattern and that distinct invalid emails map to distinct Indicators.

Author: SamuelHassine

external-import/ctm360-cyberblindspot-feed/src/connector/converter_to_stix.py

@@ -330,11 +330,18 @@ def breached_credentials_to_stix(self, creds: list) -> list:
                     pattern = f"[email-addr:value = '{self._escape_stix_value(email)}']"
                     indicator_name = f"Breached credential: {email}"
                 else:
+                    # Fall back to the email when there is no username (the email
+                    # may be present but lack an "@"). indicator_value is truthy
+                    # here, so username-or-email is guaranteed non-empty and the
+                    # pattern is never an empty/constant string — an empty pattern
+                    # would collapse unrelated records onto one Indicator id. This
+                    # mirrors the UserAccount account_login below.
+                    account_login = username or email
                     pattern = (
                         "[user-account:account_login = "
-                        f"'{self._escape_stix_value(username)}']"
+                        f"'{self._escape_stix_value(account_login)}']"
                     )
-                    indicator_name = f"Breached credential: {username}"
+                    indicator_name = f"Breached credential: {account_login}"
 
                 # Derive the Indicator id from its STIX pattern via the pycti
                 # generator so the same credential pattern de-duplicates across

external-import/ctm360-cyberblindspot-feed/tests/test_connector/test_converter_to_stix.py

@@ -443,6 +443,32 @@ def test_no_identifiers_skips_indicator(self, converter):
         assert "user-account" in types
         assert "note" in types
 
+    def test_invalid_email_without_username_uses_nonempty_pattern(self, converter):
+        # An email present but invalid (no "@") with no username must not yield
+        # an empty user-account pattern (which would collapse unrelated records
+        # onto a single constant Indicator id). It falls back to the email value
+        # and stays consistent with the UserAccount account_login.
+        objects = converter.breached_credentials_to_stix(
+            [{"id": "C4", "email": "not-an-email"}]
+        )
+        indicators = [o for o in objects if o.type == "indicator"]
+        assert indicators
+        assert indicators[0].pattern == "[user-account:account_login = 'not-an-email']"
+        user_accounts = [o for o in objects if o.type == "user-account"]
+        assert user_accounts[0].account_login == "not-an-email"
+
+    def test_invalid_email_indicator_ids_are_distinct(self, converter):
+        # Two records with different invalid emails (and no username) must map to
+        # distinct Indicators rather than collapsing onto one empty-pattern id.
+        objects = converter.breached_credentials_to_stix(
+            [
+                {"id": "C5", "email": "bad-one"},
+                {"id": "C6", "email": "bad-two"},
+            ]
+        )
+        indicator_ids = {o.id for o in objects if o.type == "indicator"}
+        assert len(indicator_ids) == 2
+
 
 class TestCardLeaksToStix:
     def test_card_leak_note(self, converter):