From 51339c2a822e8c8634324b9eea03c9a18fc50864 Mon Sep 17 00:00:00 2001 From: Christian Studer Date: Fri, 26 May 2023 15:14:44 +0200 Subject: [PATCH] fix: [crowdsec] Kepping the original attribute used to query the module unchanged --- misp_modules/modules/expansion/crowdsec.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/misp_modules/modules/expansion/crowdsec.py b/misp_modules/modules/expansion/crowdsec.py index e1814d1..5b250ce 100644 --- a/misp_modules/modules/expansion/crowdsec.py +++ b/misp_modules/modules/expansion/crowdsec.py @@ -80,7 +80,6 @@ def _handler_v2(request_data): ) tag = f'crowdsec:behavior="{behavior["name"]}"' ip_attribute.add_tag(tag) - misp_attribute.add_tag(tag) for feature, values in crowdsec_cti['classifications'].items(): field = feature[:-1] for value in values: @@ -89,7 +88,6 @@ def _handler_v2(request_data): ) tag = f'crowdsec:{field}="{value["name"]}"' ip_attribute.add_tag(tag) - misp_attribute.add_tag(tag) crowdsec_context_object.add_attribute( "attack-details", ", ".join(