diff --git a/pymisp/tools/openioc.py b/pymisp/tools/openioc.py index 78f42c9..a40299f 100755 --- a/pymisp/tools/openioc.py +++ b/pymisp/tools/openioc.py @@ -218,11 +218,12 @@ def set_values(value1, value2=None): compositeMapping = '{}|{}'.format(value1.find('context')['search'], value2.find('context')['search']) mapping = get_mapping(compositeMapping, mappingDict=iocMispCompositeMapping) else: + context_search = value1.find('context')['search'] content_type = value1.find('content').get('type', None) - if content_type: - mapping = get_mapping(value1.find('context')['search'] + '/' + content_type) + if "RouteEntryItem/Destination" in context_search and content_type: + mapping = get_mapping(context_search + '/' + content_type) else: - mapping = get_mapping(value1.find('context')['search']) + mapping = get_mapping(context_search) if mapping: attribute_values.update(mapping)