Add public search indicators to default catalog and Sigma rules

tests/test_intel_inventory.py

@@ -32,6 +32,16 @@ class IntelInventoryTests(unittest.TestCase):
             with self.subTest(indicator=row["id"]):
                 self.assertTrue(row["roles"])
                 self.assertTrue(row["observations"])
+                if row.get("provenance") == "unattributed_public_indicator":
+                    self.assertEqual(row["status"], "reference_only")
+                    self.assertEqual(row["source_ids"], [])
+                    self.assertEqual(row["source_urls"], [])
+                    self.assertEqual(row["roles"], ["search_candidate"])
+                    for observation in row["observations"]:
+                        self.assertEqual(observation["source_dates"], [])
+                        self.assertEqual(observation["source_ids"], [])
+                        self.assertEqual(observation["confidence"], "low")
+                    continue
                 self.assertTrue(row["source_ids"])
                 for source_id in row["source_ids"]:
                     self.assertIn(source_id, sources)