Observation
datafeeds.get(..., max_age_hours=24.0) refreshes over the network whenever the cache is older than 24h (or absent) and offline is not explicitly passed:
elif age is None or age > max_age_hours:
update(feed_id, catalog=catalog, query=query)The enrichment layer (feeds.control_titles, feeds.attack_control_index, feeds.enrich_result) all take offline as a per-call argument that defaults to False. So on a fresh checkout, the first feeds enrich (without --offline) will attempt an outbound HTTPS fetch.
Why it matters
The whole design goal is edge/air-gap-first ("re-served offline so the tool keeps working on disconnected gear"). But the default posture is online, and there's no single switch to make the whole process refuse the network. On a genuinely air-gapped box the fetch just fails slowly (retry/backoff) before falling back, and in a locked-down enclave an unexpected egress attempt can itself be a finding.
Suggested approach
Honor an env var (e.g. COGNIS_FEEDS_OFFLINE=1) as a global default for offline across datafeeds.get and the feeds.* helpers, so an operator can set offline-first once for the whole tool. The CLI --offline flag would still override per-invocation. Keeps the current default behaviour when the env is unset.
Observation
datafeeds.get(..., max_age_hours=24.0)refreshes over the network whenever the cache is older than 24h (or absent) andofflineis not explicitly passed:The enrichment layer (
feeds.control_titles,feeds.attack_control_index,feeds.enrich_result) all takeofflineas a per-call argument that defaults toFalse. So on a fresh checkout, the firstfeeds enrich(without--offline) will attempt an outbound HTTPS fetch.Why it matters
The whole design goal is edge/air-gap-first ("re-served offline so the tool keeps working on disconnected gear"). But the default posture is online, and there's no single switch to make the whole process refuse the network. On a genuinely air-gapped box the fetch just fails slowly (retry/backoff) before falling back, and in a locked-down enclave an unexpected egress attempt can itself be a finding.
Suggested approach
Honor an env var (e.g.
COGNIS_FEEDS_OFFLINE=1) as a global default forofflineacrossdatafeeds.getand thefeeds.*helpers, so an operator can set offline-first once for the whole tool. The CLI--offlineflag would still override per-invocation. Keeps the current default behaviour when the env is unset.