the RequestException can wrap only the requests.get, there's no need to wrap all the logic

Will move the RequestException to only wrap the network call.

a response.raise_for_status() is enough and more comprehensive that this check.

Makes sense! Will use raise_for_status() for cleaner error handling.

I won't update the already existing IOCs because the extracted information from FireHol is to be considered as "new" intelligence, so, on the contrary, I would instead touch where a new IOC is usually added by the already existing normal routines. There I expect a query of that newly found IP address in the FireHolList, and ONLY for the recently added IP addresses (the "added" parameter should queried). If it's present, then populate the firehol_categories.

considering this, we should also add an additional routine at the end of this cron that deletes the old FireHol items because they are not useful anymore in the database. That database could become really big so it is important to keep it clean

Makes sense to only enrich newly discovered IOCs rather than retroactively updating all existing ones. Will:

1. Remove immediate IOC updates during extraction
2. Add a batch enrichment step for recently added IOCs
3. Add cleanup routine for old FireHolList entries
   Thanks for the guidance!

my idea was to leverage the firehol data for fresh new data: to do that we need to touch the "iocs_from_hits" method where we actually save newly found IOCs. This is important to keep the data consistent.
In that case, since a version is deployed, we will have the new IOCs populated with the new data.
The old ones, even if collected in the last day, should not be touched because the information collected from firehol should be considered fresh only at the time of extraction. So this method must be moved where the IOC objects is populated

You're absolutely right, enriching recent IOCs retroactively could lead to inconsistencies.

I'll move the FireHol enrichment logic to the iocs_from_hits function where IOC objects are initially created. Now FireHol categories are populated at IOC creation time.

The _enrich_recent_iocs method has been removed from the FireHolCron class as it's no longer needed.

Changes made:

• greedybear/cronjobs/extraction/utils.py: Added FireHol enrichment at IOC creation
• greedybear/cronjobs/firehol.py: Removed _enrich_recent_iocs method

I like this, just one thing: this adds complexity to the current function, could you please move it outside of the main function? I expect a single line in iocs_from_hits

Done! I've extracted the FireHol enrichment logic into a separate get_firehol_categories() function. Now iocs_from_hits has a clean single-line call as you suggested:

def iocs_from_hits(hits: list[dict]) -> list[IOC]:
    """Convert Elasticsearch hits into IOC objects..."""
    hits_by_ip = defaultdict(list)
    for hit in hits:
        hits_by_ip[hit["src_ip"]].append(hit)
    iocs = []
    for ip, hits in hits_by_ip.items():
        dest_ports = [hit["dest_port"] for hit in hits if "dest_port" in hit]
        extracted_ip = ip_address(ip)
        if extracted_ip.is_loopback or extracted_ip.is_private or extracted_ip.is_multicast or extracted_ip.is_link_local or extracted_ip.is_reserved:
            continue

        firehol_categories = get_firehol_categories(ip, extracted_ip)  # Single line call

        ioc = IOC(
            name=ip,
            type=get_ioc_type(ip),
            interaction_count=len(hits),
            ip_reputation=correct_ip_reputation(ip, hits[0].get("ip_rep", "")),
            asn=hits[0].get("geoip", {}).get("asn"),
            destination_ports=sorted(set(dest_ports)),
            login_attempts=len(hits) if hits[0].get("type", "") == "Heralding" else 0,
            firehol_categories=firehol_categories,
        )
        # ... rest of the code

could you also add a test for this inside the IocsFromHitsTestCase class?

Nice catch! I missed this in tests. I've added comprehensive tests for the FireHol enrichment functionality in the IocsFromHitsTestCase class. The tests cover:

• Exact IP match enrichment (.ipset files)
• CIDR network range match enrichment (.netset files)
• No match scenarios
• Mixed exact and network range matches
• Source deduplication

All tests passing.