admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes to validate

Browse Source
This commit is contained in:
patel-bhavin
2023-04-17 16:06:37 -07:00
parent fc34672ca4
commit 932b49ccfd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
+2 -2
View File
@@ -73,6 +73,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'):
for entity in self.security_content_obj.tags.observable:
risk_object = dict()
if entity['type'].lower() in risk_object_user_types:
risk_object['risk_object_type'] = 'user'
@@ -86,10 +87,9 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
risk_object['risk_score'] = self.security_content_obj.tags.risk_score
risk_objects.append(risk_object)
elif 'Attacker' in (entity['role']):
elif 'role' in entity and 'Attacker' in entity['role']:
risk_object['threat_object_field'] = entity['name']
risk_object['threat_object_type'] = entity['type'].lower()
risk_object['risk_score'] = self.security_content_obj.tags.risk_score
risk_objects.append(risk_object)
else:
risk_object['risk_object_type'] = 'other'