New Responder: Suspicious_Verdict

Feature description

Suspicious_Verdict is a new Responder designed to integrate TheHive with the Suspicious platform developed by THA-CERT. It automates the classification of investigations by fetching a specific verdict tag from a Case or Alert in TheHive and pushing it to the Suspicious API.

Describe the solution you'd like

Once installed and configured with the Suspicious API URL and Token, the responder can be triggered manually with tags or automatically (via TheHive notifications).
It performs the following actions:

1. Extracts the Suspicious Case ID directly from the Case/Alert title.
2. Looks for a specific machine tag from the suspicious taxonomy (e.g., suspicious:verdict="DANGEROUS").
3. Pushes the classification (SAFE, SUSPICIOUS, or DANGEROUS) to the Suspicious platform via its API.
4. Upon successful API update, the responder appends a new tag suspicious:status="challenge_reviewed." back to the Case or Alert in TheHive to indicate the operation was completed.

Additional context

The responder handles error management cleanly (e.g., missing ID, multiple contradictory tags, or missing tags) and requires the requests library.
A corresponding taxonomy suspicious/machinetag.json is used to standardize the verdicts. I am currently preparing the PR for this responder.
This responder is designed to be used in conjunction with a TheHive Notification template (to be submitted in the Strangebee Integrations repository) that automatically triggers this responder when a taxonomy tag is added.
A machine-tag taxonomy (suspicious) will also be provided in this PR.

Start by reviewing the responder configuration requirements and the proposed suspicious/machinetag.json taxonomy. Verify handling for missing IDs, contradictory or missing verdict tags, API errors, and successful updates; done means the responder sends SAFE, SUSPICIOUS, or DANGEROUS to the Suspicious API and appends the completed status tag in TheHive.