From 5be841d08a0a06a689291102164467149a00c3be Mon Sep 17 00:00:00 2001
From: Shreya Malviya <shreya.malviya@gmail.com>
Date: Wed, 6 Oct 2021 19:23:24 +0530
Subject: [PATCH] island: For ATT&CK techniques mapped to PBAs, consider
 hostname and IP of the first entry in the PBA's results

---
 .../cc/services/attack/technique_reports/pba_technique.py    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
index a1abc67ee..3cc3d4085 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/pba_technique.py
@@ -39,7 +39,10 @@ class PostBreachTechnique(AttackTechnique, metaclass=abc.ABCMeta):
             {
                 "$project": {
                     "_id": 0,
-                    "machine": {"hostname": "$data.hostname", "ips": ["$data.ip"]},
+                    "machine": {
+                        "hostname": {"$arrayElemAt": ["$data.hostname", 0]},
+                        "ips": [{"$arrayElemAt": ["$data.ip", 0]}],
+                    },
                     "result": "$data.result",
                 }
             },