getenumCI2021() not correctly creating sample when single enum specificed

getenumCI2021() should (and prior versions do) take an enum such as "action.malware.variety.Ransomware" and use "action.malware.variety" as the sample. Instead, it is using the full "action.malware.variety.Ransomware" (or whatever enum) as the sample, causing it to always come back 100%.

This can easily be worked around by using "action.malware.variety" and then filtering to enum == "Ransomware or such, but should try and fix the sample size creation for consistency with previous versions.

vz-risk / verisr

getenumCI2021() not correctly creating sample when single enum specificed #23