atc-project / atomic-threat-coverage

Actionable analytics designed to combat threats
Apache License 2.0
962 stars 155 forks source link

es-index-export.py does not handle missing fields in DN #228

Open wbnod opened 2 years ago

wbnod commented 2 years ago

Script for exporting Elastic index, atomic-threat-coverage/scripts/es-index-export.py breaks when executing Makefile because some data/atc/dataneeded/DN### files are missing required keys, e.g. 'provider:'.

error line 258 in __init__:
if dn['provider'] not in dn_providers:
KeyError: 'provider'

Best case solution is if upstream DN_files are correctly formed with all needed keys present. Since we cannot guarantee that, es-export-index.py needs to provide some level of resilience rather than failing altogether.

Workaround is to wrap block in try/except for error handling. Likely needed for other blocks as well.

try:
    for dn in alert_dns:
        ...
except:
    pass