"""SQLAlchemy model for the intel_items table.""" # Import uuid import uuid # Import Boolean, Column, DateTime, ForeignKey, String, ... from sqlalchemy from sqlalchemy import Boolean, Column, DateTime, ForeignKey, String, func # Import UUID from sqlalchemy.dialects.postgresql from sqlalchemy.dialects.postgresql import UUID # Import relationship from sqlalchemy.orm from sqlalchemy.orm import relationship # Import Base from app.database from app.database import Base # Define class IntelItem class IntelItem(Base): """Intelligence item model for tracking threat intelligence related to techniques. Stores URLs and metadata from automated intel scans that may indicate new attack variations or detection bypasses for specific techniques. """ # Assign __tablename__ = "intel_items" __tablename__ = "intel_items" # Assign id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4) id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4) # Assign technique_id = Column(UUID(as_uuid=True), ForeignKey("techniques.id"), nullable=True) technique_id = Column(UUID(as_uuid=True), ForeignKey("techniques.id"), nullable=True) # Assign url = Column(String, nullable=False) url = Column(String, nullable=False) # Assign title = Column(String, nullable=True) title = Column(String, nullable=True) # Assign source = Column(String, nullable=True) source = Column(String, nullable=True) # Assign detected_at = Column(DateTime(timezone=True), server_default=func.now()) detected_at = Column(DateTime(timezone=True), server_default=func.now()) # Assign reviewed = Column(Boolean, default=False) reviewed = Column(Boolean, default=False) # Relationships technique = relationship("Technique")