fix: entity mapping issues for Sigma

certeu · Nov 12, 2024 · bd58575 · bd58575
1 parent 7f2dd76
commit bd58575
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/droid/platforms/sentinel.py b/src/droid/platforms/sentinel.py
@@ -422,12 +422,14 @@ def create_rule(self, rule_content, rule_converted, rule_file):
             enabled = True
 
         # Handling the entities
-        entity_mappings = []
         if rule_content.get('custom', {}).get('entity_mappings'):
+            entity_mappings = []
             for mapping in rule_content['custom']['entity_mappings']:
                 field_mappings = [FieldMapping(identifier=field['identifier'], column_name=field['column_name'])
                                     for field in mapping['field_mappings']]
                 entity_mappings.append(EntityMapping(entity_type=mapping['entity_type'], field_mappings=field_mappings))
+        else:
+            entity_mappings = None
 
         # Handling the severity
         if rule_content['level'] == 'critical':