From ece9f45a762da1e67cfa59cbcd87bfaf1e3e469c Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 3 Jun 2019 15:20:03 -0700 Subject: [PATCH] checking for value types for risk scores --- src/bin/detect.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/bin/detect.py b/src/bin/detect.py index 45b447bef4..8a743704d3 100644 --- a/src/bin/detect.py +++ b/src/bin/detect.py @@ -136,12 +136,19 @@ class DetectCommand(GeneratingCommand): detection_results.append(dict(result)) for key, value in result.items(): - if key in search['risk_object'] and value not in common_field: + if type(value) == list: + for i in value: + if i not in common_field: + common_field.append(i) + + + if type(value) == str and key in search['risk_object'] and value not in common_field: common_field.append(value) for i in common_field: f.write("-------->>>>>>>"+ str(i)+ "\n\n") - create_risk_score="|makeresults" +"| eval search_name=\"" + search['search_name'] +"\"" + "| eval risk_object=\"" + i +"\"" + "|eval risk_score = \""+ search['risk_score'] + "\"" "| eval risk_object_type=\"" + search['risk_object_type'] +"\"" +"| sendalert risk" + + create_risk_score="|makeresults" +"| eval search_name=\"" + search['search_name'] +"\"" + "| eval risk_object=\"" + str(i) +"\"" + "|eval risk_score = \""+ search['risk_score'] + "\"" "| eval risk_object_type=\"" + search['risk_object_type'] +"\"" +"| sendalert risk" kwargs = { "exec_mode": "normal","earliest_time": earliest_time, "latest_time": latest_time}