diff --git a/misp_modules/lib/joe_parser.py b/misp_modules/lib/joe_parser.py index 182398f..4b4c4c1 100644 --- a/misp_modules/lib/joe_parser.py +++ b/misp_modules/lib/joe_parser.py @@ -146,10 +146,12 @@ class JoeParser(): relationship_type='initiates')) def parse_screenshot(self): - screenshotdata = self.data['behavior']['screenshotdata']['interesting']['$'] - attribute = {'type': 'attachment', 'value': 'screenshot.jpg', - 'data': screenshotdata, 'disable_correlation': True} - self.misp_event.add_attribute(**attribute) + screenshotdata = self.data['behavior']['screenshotdata'] + if screenshotdata: + screenshotdata = screenshotdata['interesting']['$'] + attribute = {'type': 'attachment', 'value': 'screenshot.jpg', + 'data': screenshotdata, 'disable_correlation': True} + self.misp_event.add_attribute(**attribute) def parse_system_behavior(self): system = self.data['behavior']['system']