Fix regression found in testing idaholab#336

cisagov · Mar 5, 2024 · b0356c8 · b0356c8
1 parent 80b6ec4
commit b0356c8
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/shared/bin/zeek_threat_feed_utils.py b/shared/bin/zeek_threat_feed_utils.py
@@ -512,7 +512,9 @@ def ProcessMISP(
                 certainty = None
 
                 # determine if we're processing an event or an attribute
-                if 'info' in toParse:
+                if (('Event' in toParse) and isinstance(toParse['Event'], dict) and ('info' in toParse['Event'])) or (
+                    'info' in toParse
+                ):
                     # this is an event, which may contain an array of attributes
                     event = MISPEvent()
                     event.from_dict(**toParse)