Fis on agent.id field for harfanglab

SEKOIA-IO · Dec 10, 2024 · e6a207c · e6a207c
1 parent 525a164
commit e6a207c
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/HarfangLab/harfanglab/ingest/parser.yml b/HarfangLab/harfanglab/ingest/parser.yml
@@ -142,6 +142,10 @@ stages:
           organization.id: "{{json_event.message.tenant}}"
           url.original: "{{json_event.message.details_url_request.url}}"
 
+      - set:
+          agent.id: "{{json_event.message.agents[0].agent_id}}"
+        filter: "{{json_event.message.agents | length > 0}}"
+
   network_info:
     actions:
       - set:

diff --git a/HarfangLab/harfanglab/tests/threat_critical.json b/HarfangLab/harfanglab/tests/threat_critical.json
@@ -10,6 +10,7 @@
       "start": "2024-03-19T09:21:00Z"
     },
     "agent": {
+      "id": "af5e2f63-becd-4660-ade8-30d04c0dd044",
       "name": "harfanglab"
     },
     "harfanglab": {

diff --git a/HarfangLab/harfanglab/tests/threat_log.json b/HarfangLab/harfanglab/tests/threat_log.json
@@ -10,6 +10,7 @@
       "start": "2024-02-07T15:18:00Z"
     },
     "agent": {
+      "id": "215fe295-905f-4a8d-8347-e9d438d4e415",
       "name": "harfanglab"
     },
     "harfanglab": {