gis-8503 fix false_positive metainfo

nazargesyk · nazargesyk · commit 51cdf695c826 · 2024-08-28T17:03:09.000+03:00
diff --git a/uncoder-core/app/translator/platforms/splunk/parsers/splunk_alert.py b/uncoder-core/app/translator/platforms/splunk/parsers/splunk_alert.py
@@ -93,6 +93,13 @@ def parse_raw_query(self, text: str, language: str) -> RawQueryContainer:
         tags = rule.get("tags", {}).get("analytic_story", [])
         if rule.get("type"):
             tags.append(rule.get("type"))
+        false_positives = None
+        if rule.get("known_false_positives"):
+            false_positives = (
+                rule["known_false_positives"]
+                if isinstance(rule["known_false_positives"], list)
+                else [rule["known_false_positives"]]
+            )
         return RawQueryContainer(
             query=rule.get("search"),
             language=language,
@@ -103,7 +110,7 @@ def parse_raw_query(self, text: str, language: str) -> RawQueryContainer:
                 author=rule.get("author").split(", "),
                 status=rule.get("status"),
                 description=description,
-                false_positives=rule.get("known_false_positives"),
+                false_positives=false_positives,
                 references=rule.get("references"),
                 mitre_attack=mitre_attack_container,
                 tags=tags,
