What Changed

Tools/QRadarMigration/qradar_collector.py bumped from 0.4.1 to 0.4.2 with substantial error-handling hardening across the pipeline orchestration layer. The core change is the introduction of a delivery_critical class-level flag on BaseHandler (defaulting to True), which the orchestrator now checks before raising a CriticalPhaseError. Handlers reclassified as non-critical include:

  • ReferenceDataHandler – QRadar reference data enrichment
  • RuleIdHandler – rule/building-block ID enumeration
  • RuleExportHandler, XmlDecodeHandler, ReferenceExtractionHandler
  • DependencyExpansionHandler, MitreMappingHandler
  • CredentialCleanupHandler

The CsvDeliveryHandler (context.require narrowed to remove expanded_rules as a mandatory prerequisite) now executes even when upstream enrichment phases fail, ensuring the minimum UCM-based CSV file is always written.

Additional defensive changes:

  • Malformed rule records (non-dict) in dependency expansion are skipped with an error counter increment rather than raising an exception
  • Null-safe handling added throughout _build_lookup_table, _build_category_lookup, _build_log_sources_lookups, and _build_rule_groups_lookup
  • _normalise_dependency_values introduced to filter unhashable and null dependency values before set operations
  • calc_qradar_version now returns UNKNOWN instead of empty string when version context is absent
  • _sort_identifier_values added for deterministic mixed numeric/string identifier sorting

Security Impact for Migration Users

The pre-0.4.2 behaviour meant that a single enrichment API failure (e.g., the QRadar reference data endpoint being unavailable) would abort the entire collection run, producing zero output. Detection engineers running QRadar-to-Sentinel migrations would receive no UCM CSV at all, potentially delaying migration planning. With 0.4.2, partial enrichment failures are recorded in the error counter and the migration artefact is still delivered. Teams should review error_counter output in collection logs to confirm which enrichment phases failed.

Affected Files

Tools/QRadarMigration/qradar_collector.py