System info attack technique's identical results grouped
This commit is contained in:
parent
e1baacd0f0
commit
09e1abb3cb
|
@ -32,7 +32,9 @@ class T1082(AttackTechnique):
|
||||||
'name': {'$literal': 'SSH info'}},
|
'name': {'$literal': 'SSH info'}},
|
||||||
{'used': {'$and': [{'$ifNull': ['$azure_info', False]}, {'$ne': ['$azure_info', []]}]},
|
{'used': {'$and': [{'$ifNull': ['$azure_info', False]}, {'$ne': ['$azure_info', []]}]},
|
||||||
'name': {'$literal': 'Azure info'}}
|
'name': {'$literal': 'Azure info'}}
|
||||||
]}}]
|
]}},
|
||||||
|
{'$group': {'_id': {'machine': '$machine', 'collections': '$collections'}}},
|
||||||
|
{"$replaceRoot": {"newRoot": "$_id"}}]
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def get_report_data():
|
def get_report_data():
|
||||||
|
|
Loading…
Reference in New Issue