Skip to content

CTIP Parser always overwrites feed.name #2022

@ghost

Description

The CTIP Parser always sets feed.name to what is found in the data:


if AZURE[key] != '__IGNORE__':
event.add(AZURE[key], value, overwrite=True)

This field should be left as is, if not explicitly required by the user, e.g. with a overwrite parameter, like it is in the Shadowserver parser.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIndicates an unexpected problem or unintended behaviorcomponent: bots

    Type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions