Skip to content

Commit fbf4e56

Browse files
monoidicsebix
andauthored
Add suggested change from sebix
Co-authored-by: Sebastian <[email protected]>
1 parent 76dbfae commit fbf4e56

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

intelmq/bots/parsers/microsoft/parser_ctip.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,8 @@ def parse_azure(self, line, report):
292292
# needs to overwrite a field previously parsed and written
293293
event.add('protocol.application', payload_protocol, overwrite=True) # "HTTP/1.1", save additionally
294294
elif key == 'Payload.domain':
295-
if not FQDN.is_valid(value):
295+
# Sometimes the destination address is also given as domain, ignore it here as we already save it as destination.ip (see https://github.com/certtools/intelmq/pull/2144)
296+
if not FQDN.is_valid(value) and value == line.get('Payload.serverIp'):
296297
continue
297298
elif not value:
298299
continue

0 commit comments

Comments
 (0)