diff --git a/sigma/processing/transformations/fields.py b/sigma/processing/transformations/fields.py index 0cc7b0d4..8d370e45 100644 --- a/sigma/processing/transformations/fields.py +++ b/sigma/processing/transformations/fields.py @@ -57,7 +57,7 @@ class FieldPrefixMappingTransformation(FieldMappingTransformation): def get_mapping(self, field: str) -> Union[None, str, List[str]]: if field is None: return None - + for src, dest in self.mapping.items(): if field.startswith(src): # found matching prefix if isinstance(dest, str):