From 80e2b2db30a21a49ec69fd6df6fb9ce996fb57b0 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Wed, 7 Oct 2026 16:07:18 -0400
Subject: [PATCH] fix(security): preserve IOC CSV record boundaries

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
---
 .../security-threat-intelligence-analyst.md   | 20 ++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/security/security-threat-intelligence-analyst.md b/security/security-threat-intelligence-analyst.md
index 4922f46a..9dc5a503 100644
--- a/security/security-threat-intelligence-analyst.md
+++ b/security/security-threat-intelligence-analyst.md
@@ -348,6 +348,8 @@ IOC enrichment pipeline.
 Takes raw indicators and enriches with context from multiple sources.
 """
 
+import csv
+import io
 import json
 import re
 import uuid
@@ -541,13 +543,17 @@ class IOCEnrichmentPipeline:
 
     def export_csv(self) -> str:
         """Export IOCs as CSV for SIEM ingestion."""
-        lines = ["indicator,type,confidence,tags,first_seen,source"]
+        # Indicator URLs and source labels may contain commas, quotes or
+        # newlines. Let the CSV writer preserve field and record boundaries.
+        output = io.StringIO(newline="")
+        writer = csv.writer(output)
+        writer.writerow(["indicator", "type", "confidence", "tags", "first_seen", "source"])
         for ioc in self.enriched:
-            lines.append(
-                f"{ioc.value},{ioc.ioc_type.value},{ioc.confidence},"
-                f"{';'.join(ioc.tags)},{ioc.first_seen.isoformat()},{ioc.source}"
-            )
-        return "\n".join(lines)
+            writer.writerow([
+                ioc.value, ioc.ioc_type.value, ioc.confidence,
+                ";".join(ioc.tags), ioc.first_seen.isoformat(), ioc.source,
+            ])
+        return output.getvalue().removesuffix("\r\n")
 
 
 # Usage:
@@ -645,4 +651,4 @@ You're successful when:
 
 ---
 
-**Instructions Reference**: Your analytical methodology is grounded in the Intelligence Community Directive 203 (Analytic Standards), Sherman Kent's principles of intelligence analysis, the Diamond Model of Intrusion Analysis, the Cyber Kill Chain, and MITRE ATT&CK — adapted for the speed and scale of modern cyber threats.
\ No newline at end of file
+**Instructions Reference**: Your analytical methodology is grounded in the Intelligence Community Directive 203 (Analytic Standards), Sherman Kent's principles of intelligence analysis, the Diamond Model of Intrusion Analysis, the Cyber Kill Chain, and MITRE ATT&CK — adapted for the speed and scale of modern cyber threats.