From 94c6e3cbe790669ced1f44aaa1dad03b78ca4b7e Mon Sep 17 00:00:00 2001
From: cccs-rs <62077998+cccs-rs@users.noreply.github.com>
Date: Tue, 6 Aug 2024 19:13:37 +0000
Subject: [PATCH] bugfix KeyError

---
 suricata_/helper.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/suricata_/helper.py b/suricata_/helper.py
index 6df3ac5..72d7988 100644
--- a/suricata_/helper.py
+++ b/suricata_/helper.py
@@ -272,7 +272,8 @@ def attach_network_connection(data: dict):
                             continue
 
                         if not any(
-                            query["rrname"] == network_part.dns_details.domain for query in record["dns"]["query"]
+                            query["rrname"] == network_part.dns_details.domain
+                            for query in record["dns"].get("query", [])
                         ):
                             # This particular record isn't relevant to the alert
                             continue