diff --git a/analyzers/LdapQuery/LdapQuery.json b/analyzers/LdapQuery/LdapQuery.json index e2d2f911a..a01a86592 100644 --- a/analyzers/LdapQuery/LdapQuery.json +++ b/analyzers/LdapQuery/LdapQuery.json @@ -1,11 +1,11 @@ { "name": "Ldap_Query", - "version": "2.0", + "version": "2.1", "author": "Florian Perret @cyber_pescadito", "url": "https://github.com/cyberpescadito/Cortex-Analyzers/tree/master/analyzers/LdapQuery", "license": "AGPL-V3", "description": "Query your LDAP server to harvest informations about an user of your organization", - "dataTypeList": ["username", "mail"], + "dataTypeList": ["account", "username", "mail"], "command": "LdapQuery/ldapQuery.py", "baseConfig": "LdapQuery", "configurationItems": [ @@ -25,7 +25,7 @@ }, { "name": "LDAP_username", - "description": "Usernae of the account that will be used to bind to LDAP server. The Account should have permissions to read ldap objects and attributes.", + "description": "Username of the account that will be used to bind to LDAP server. The Account should have permissions to read ldap objects and attributes.", "type": "string", "multi": false, "required": true @@ -59,4 +59,4 @@ "required": true } ] -} \ No newline at end of file +} diff --git a/responders/MSDefenderEndpoints/MSDefenderEndpoints.py b/responders/MSDefenderEndpoints/MSDefenderEndpoints.py index 8775fd5f9..8906da7fe 100755 --- a/responders/MSDefenderEndpoints/MSDefenderEndpoints.py +++ b/responders/MSDefenderEndpoints/MSDefenderEndpoints.py @@ -31,7 +31,7 @@ def __init__(self): def run(self): Responder.run(self) - url = "{}{}/oauth2/token".format( + url = "{}/{}/oauth2/token".format( self.msdefenderOAuthUri,self.msdefenderTenantId ) @@ -77,7 +77,8 @@ def getMachineId(id): if response.status_code == 200: jsonResponse = response.json() if len(response.content) > 100: - return jsonResponse["value"][0]["aadDeviceId"] + if jsonResponse["value"][0]["aadDeviceId"] is None: + return jsonResponse["value"][0]["id"] else: self.error({'message': "Can't get hostname from Microsoft API"}) except requests.exceptions.RequestException as e: