From 932b49ccfd25ba99bb83dd3ca2bfb711632d2008 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 17 Apr 2023 16:06:37 -0700 Subject: [PATCH] fixes to validate --- .../builder/security_content_detection_builder.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 0a1e764a50..510d27162f 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -73,6 +73,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'): for entity in self.security_content_obj.tags.observable: + risk_object = dict() if entity['type'].lower() in risk_object_user_types: risk_object['risk_object_type'] = 'user' @@ -86,10 +87,9 @@ class SecurityContentDetectionBuilder(DetectionBuilder): risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) - elif 'Attacker' in (entity['role']): + elif 'role' in entity and 'Attacker' in entity['role']: risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() - risk_object['risk_score'] = self.security_content_obj.tags.risk_score risk_objects.append(risk_object) else: risk_object['risk_object_type'] = 'other'