diff --git a/bot/irc/mozdefbot.py b/bot/irc/mozdefbot.py index 18b44cb9d..7e48faa1b 100755 --- a/bot/irc/mozdefbot.py +++ b/bot/irc/mozdefbot.py @@ -303,7 +303,10 @@ def on_message(self, body, message): "alertworker exception: unknown body type received %r" % body) return - body_dict = full_body['_source'] + body_dict = full_body + # Handle messages that have full ES dict + if '_source' in full_body: + body_dict = full_body['_source'] if 'notify_mozdefbot' in body_dict and body_dict['notify_mozdefbot'] is False: # If the alert tells us to not notify, then don't post to IRC diff --git a/bot/slack/mozdefbot.py b/bot/slack/mozdefbot.py index 3b3cd11e0..3fb8fdad3 100644 --- a/bot/slack/mozdefbot.py +++ b/bot/slack/mozdefbot.py @@ -59,7 +59,11 @@ def on_message(self, body, message): else: logger.exception("mozdefbot_slack exception: unknown body type received %r" % body) return - body_dict = full_body['_source'] + + body_dict = full_body + # Handle messages that have full ES dict + if '_source' in full_body: + body_dict = full_body['_source'] if 'notify_mozdefbot' in body_dict and body_dict['notify_mozdefbot'] is False: # If the alert tells us to not notify, then don't post message