System info attack technique's identical results grouped

This commit is contained in:
VakarisZ 2019-07-10 09:11:13 +03:00
parent e1baacd0f0
commit 09e1abb3cb
1 changed files with 3 additions and 1 deletions

View File

@ -32,7 +32,9 @@ class T1082(AttackTechnique):
'name': {'$literal': 'SSH info'}}, 'name': {'$literal': 'SSH info'}},
{'used': {'$and': [{'$ifNull': ['$azure_info', False]}, {'$ne': ['$azure_info', []]}]}, {'used': {'$and': [{'$ifNull': ['$azure_info', False]}, {'$ne': ['$azure_info', []]}]},
'name': {'$literal': 'Azure info'}} 'name': {'$literal': 'Azure info'}}
]}}] ]}},
{'$group': {'_id': {'machine': '$machine', 'collections': '$collections'}}},
{"$replaceRoot": {"newRoot": "$_id"}}]
@staticmethod @staticmethod
def get_report_data(): def get_report_data():