Fix: Handle None case in field_name_prefix_mapping

SigmaHQ · Jan 7, 2025 · d20c524 · d20c524
1 parent b5f6c1d
commit d20c524
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/sigma/processing/transformations/fields.py b/sigma/processing/transformations/fields.py
@@ -55,6 +55,9 @@ class FieldPrefixMappingTransformation(FieldMappingTransformation):
     """Map a field name prefix to one or multiple different prefixes."""
 
     def get_mapping(self, field: str) -> Union[None, str, List[str]]:
+        if field is None:
+            return None
+
         for src, dest in self.mapping.items():
             if field.startswith(src):  # found matching prefix
                 if isinstance(dest, str):