From 265ce115a067a2b04f03ed83cb455cd3370ef4f2 Mon Sep 17 00:00:00 2001 From: Thomas Patzke Date: Tue, 16 Oct 2018 13:57:51 +0200 Subject: [PATCH] Fixed conditional field mapping usage in mapping chains --- tools/sigma/config/mapping.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/sigma/config/mapping.py b/tools/sigma/config/mapping.py index 8e5150e1f..a054ffd3f 100644 --- a/tools/sigma/config/mapping.py +++ b/tools/sigma/config/mapping.py @@ -165,14 +165,14 @@ class FieldMappingChain(object): for fieldname in current_fieldmappings: mapping = config.get_fieldmapping(fieldname) - if type(mapping) in (SimpleFieldMapping, ConditionalFieldMapping): + if type(mapping) in (SimpleFieldMapping, MultiFieldMapping): resolved_mapping = mapping.resolve_fieldname(fieldname) if type(resolved_mapping) is list: fieldmappings.update(resolved_mapping) else: fieldmappings.add(resolved_mapping) - elif type(mapping) == MultiFieldMapping: - fieldmappings.update(mapping.resolve_fieldname(fieldname)) + elif type(mapping) == ConditionalFieldMapping: + fieldmappings.add(mapping) else: raise TypeError("Type '{}' is not supported by FieldMappingChain".format(str(type(mapping))))