fix to avoid empty lists

SEKOIA-IO · Dec 11, 2024 · 0c17da5 · 0c17da5
1 parent bc460dc
commit 0c17da5
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 13 deletions.
diff --git a/Cisco/cisco-esa/ingest/parser.yml b/Cisco/cisco-esa/ingest/parser.yml
@@ -209,16 +209,6 @@ stages:
                 {% endif %}
               {% endif %}
             {%- endfor %}]
-          cisco.esa.url_domain: >-
-            [{% for url, details in json_event_url_details.message.items() %}
-              {% if details.get('ExpandedUrl') is not none %}"{{url.replace('https://','').replace('http://','').split('/')[0]}}", "{{ details.ExpandedUrl.replace('https://','').replace('http://','').split('/')[0] }}"{% else %}"{{ url.replace('https://','').replace('http://','').split('/')[0] }}"{% endif %}
-              {% if not loop.last %},{% endif %}
-            {% endfor %}]
-          cisco.esa.url: >-
-            [{% for url, details in json_event_url_details.message.items() %}
-              {% if details.get('ExpandedUrl') is not none %}"{{url}}", "{{ details.ExpandedUrl }}"{% else %}"{{ url }}"{% endif %}
-              {% if not loop.last %},{% endif %}
-            {% endfor %}]
           url.domain: "{{parsed_event.message.EAURLDetails}}"
           cisco.esa.delivery.connection_id: "{{parsed_event.message.ESADCID}}"
           cisco.esa.injection.connection_id: "{{parsed_event.message.ESAICID}}"
@@ -237,6 +227,19 @@ stages:
           cisco.esa.helo.ip: "{{parsed_event.message.ESAHeloIP}}"
         filter: "{{parsed_event.message.ESAHeloIP | is_ipaddress}}"
 
+      - set:
+          cisco.esa.url_domain: >-
+            [{% for url, details in json_event_url_details.message.items() %}
+              {% if details.get('ExpandedUrl') is not none %}"{{url.replace('https://','').replace('http://','').split('/')[0]}}", "{{ details.ExpandedUrl.replace('https://','').replace('http://','').split('/')[0] }}"{% else %}"{{ url.replace('https://','').replace('http://','').split('/')[0] }}"{% endif %}
+              {% if not loop.last %},{% endif %}
+            {% endfor %}]
+          cisco.esa.url: >-
+            [{% for url, details in json_event_url_details.message.items() %}
+              {% if details.get('ExpandedUrl') is not none %}"{{url}}", "{{ details.ExpandedUrl }}"{% else %}"{{ url }}"{% endif %}
+              {% if not loop.last %},{% endif %}
+            {% endfor %}]
+        filter: "{{json_event_url_details.message | length > 0}}"
+
       - set:
           cisco.esa.helo.domain: "{{parsed_event.message.ESAHeloDomain}}"
           cisco.esa.sender_group: "{{parsed_event.message.ESASenderGroup}}"

diff --git a/Cisco/cisco-esa/tests/test_ingest_log7.json b/Cisco/cisco-esa/tests/test_ingest_log7.json
@@ -54,9 +54,7 @@
           "domain": {
             "age": "30 days (or greater)"
           }
-        },
-        "url": [],
-        "url_domain": []
+        }
       }
     },
     "email": {