Add Suspicious_Verdict Responder

[EnzoCyberSec]

Summary

Adds Suspicious_Verdict, a Responder that pushes the triage verdict (SAFE / SUSPICIOUS / DANGEROUS) set on a TheHive Case or Alert to the matching investigation in Suspicious, the case management platform maintained by Thales CERT.

What's included

• responders/Suspicious_Verdict/suspicious_verdict.py — responder logic
• responders/Suspicious_Verdict/Suspicious_Verdict.json — service interaction file
• responders/Suspicious_Verdict/requirements.txt — requests, cortexutils
• responders/Suspicious_Verdict/taxonomy/machinetag.json — suspicious taxonomy
  (verdict tags: SAFE / SUSPICIOUS / DANGEROUS)
• responders/Suspicious_Verdict/README.md — full documentation (behaviour,
  taxonomy table, configuration, manual and automatic triggering)

Verification performed

• ✅ Tested with a valid configuration (suspicious_url, suspicious_token) against a live Suspicious instance: verdict tags correctly update the investigation's classification, score and confidence.
• ✅ Tested with missing configuration: the responder raises an explicit Cortex error instead of failing silently.
• ✅ Tested with a Case/Alert missing tags, missing a valid verdict tag, or containing several verdict tags at once: each case returns an explicit error message.
• ✅ Tested on both thehive:case and thehive:alert data types.

Related contribution

A companion TheHive notification that automatically triggers this responder when a suspicious:verdict= tag is added is submitted separately in StrangeBee/integrations (folder integrations/vendors/Suspicious/thehive/functions), as that repository is the one scoped to TheHive notifications/integrations. Both READMEs cross-reference each other.

[EnzoCyberSec]

Refer to the issue #1496