Preserve bracketed prefixes when stripping email subject markers

[adulau]

Motivation

• The subject-marker regex was consuming arbitrary leading bracketed prefixes (e.g. [CASE-123], [TLP:AMBER]) when a reply/forward marker followed, losing analyst-relevant context.
• The intent is to strip only common reply/forward markers (like RE:, Fwd: and indexed variants) while preserving meaningful bracketed metadata.

Description

• Restrict the subject-strip pattern in misp_modules/modules/import_mod/email_import.py by removing the leading (?:\[[^\]]+\]\s*)* subpattern so the regex only matches the actual reply/forward marker sequence (SUBJECT_MARKER_RE).
• Keep support for common tokens and indexed variants (e.g. RE, FW, AW[2]) and repeated stripping via remove_common_subject_markers unchanged.
• Add regression tests in tests/test_email_import_subject_markers.py that mock pymisp.tools to import remove_common_subject_markers and assert preservation of bracketed prefixes and correct stripping of reply/forward markers.

Testing

• Ran pytest tests/test_email_import_subject_markers.py -q, which executed the added tests and reported 2 passed.
• No other automated test suites were modified or executed as part of this change.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe86bb2fe2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Strip markers that follow preserved bracket prefixes

When remove_subject_markers is enabled, subjects that begin with analyst metadata followed by a reply marker now keep the marker because the anchored regex only matches after whitespace. For example, [CASE-123] RE: malware returns [CASE-123] RE: malware instead of preserving the prefix while stripping the marker to [CASE-123] malware, so common ticket/TLP-prefixed replies are no longer normalized by this option. Consider matching the bracketed prefix separately and retaining it while removing the following marker.

Useful? React with 👍 / 👎.