island: For ATT&CK techniques mapped to PBAs, consider hostname and IP

of the first entry in the PBA's results
This commit is contained in:
Shreya Malviya 2021-10-06 19:23:24 +05:30
parent f7e37b0767
commit 5be841d08a
1 changed files with 4 additions and 1 deletions

View File

@ -39,7 +39,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
{ {
"$project": { "$project": {
"_id": 0, "_id": 0,
"machine": {"hostname": "$data.hostname", "ips": ["$data.ip"]}, "machine": {
"hostname": {"$arrayElemAt": ["$data.hostname", 0]},
"ips": [{"$arrayElemAt": ["$data.ip", 0]}],
},
"result": "$data.result", "result": "$data.result",
} }
}, },