Fix cisco-esa

SEKOIA-IO · Dec 2, 2024 · 4021572 · 4021572
1 parent b226271
commit 4021572
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 5 deletions.
diff --git a/Cisco/cisco-esa/ingest/parser.yml b/Cisco/cisco-esa/ingest/parser.yml
@@ -70,6 +70,7 @@ pipeline:
     external:
       name: dict.parse
       properties:
+        output_field: message
         input_field: >
           {{ parsed_event.message.ESAURLDetails }}
 
@@ -213,7 +214,7 @@ stages:
               {% endif %}
             {%- endfor %}]
           cisco.esa.url: >-
-            [{% for url, details in dict(json_event_url_details.message).items() %}
+            [{% for url, details in json_event_url_details.message.items() %}
               "{% if details.get('ExpandedUrl') is not none %}{{ details.ExpandedUrl }}{% else %}{{ url }}{% endif %}"
               {% if not loop.last %},{% endif %}
             {% endfor %}]

diff --git a/Cisco/cisco-esa/tests/test_attachments_details.json b/Cisco/cisco-esa/tests/test_attachments_details.json
@@ -54,7 +54,11 @@
           "domain": {
             "age": "30 days (or greater)"
           }
-        }
+        },
+        "url": [
+          "http://schemas.microsoft.com/office/2004/12/omml",
+          "http://www.w3.org/TR/REC-html40"
+        ]
       }
     },
     "email": {

diff --git a/Cisco/cisco-esa/tests/test_ingest_log2.json b/Cisco/cisco-esa/tests/test_ingest_log2.json
@@ -57,7 +57,11 @@
           "domain": {
             "age": "9 years 3 months 14 days"
           }
-        }
+        },
+        "url": [
+          "http://mandrill.appc.cisco.com/track/open.php?u=30372747&id=d57275a6c9df40418a90fd977e3bf506",
+          "https://bce-demo.appc.cisco.com/sensors/a7b04388-0f6e-11e9-8def-0242ac110002"
+        ]
       }
     },
     "email": {

diff --git a/Cisco/cisco-esa/tests/test_ingest_log5.json b/Cisco/cisco-esa/tests/test_ingest_log5.json
@@ -51,7 +51,12 @@
           "domain": {
             "age": "30 days (or greater)"
           }
-        }
+        },
+        "url": [
+          "https://facebook.com/u/john.doe",
+          "https://tiktok.com",
+          "www.twitter.com"
+        ]
       }
     },
     "email": {

diff --git a/Cisco/cisco-esa/tests/test_ingest_log7.json b/Cisco/cisco-esa/tests/test_ingest_log7.json
@@ -54,7 +54,8 @@
           "domain": {
             "age": "30 days (or greater)"
           }
-        }
+        },
+        "url": []
       }
     },
     "email": {