island: For ATT&CK techniques mapped to PBAs, consider hostname and IP
of the first entry in the PBA's results
This commit is contained in:
parent
f7e37b0767
commit
5be841d08a
|
@ -39,7 +39,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
|
|||
{
|
||||
"$project": {
|
||||
"_id": 0,
|
||||
"machine": {"hostname": "$data.hostname", "ips": ["$data.ip"]},
|
||||
"machine": {
|
||||
"hostname": {"$arrayElemAt": ["$data.hostname", 0]},
|
||||
"ips": [{"$arrayElemAt": ["$data.ip", 0]}],
|
||||
},
|
||||
"result": "$data.result",
|
||||
}
|
||||
},
|
||||
|
|
Loading…
Reference in New Issue