Fix the port_scan_enrichment alert plugin (#1547)

mozilla · Apr 15, 2020 · d4c3514 · d4c3514
1 parent d005603
commit d4c3514
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 8 deletions.
diff --git a/alerts/plugins/port_scan_enrichment.py b/alerts/plugins/port_scan_enrichment.py
@@ -83,7 +83,7 @@ class message(object):
 
     def __init__(self):
         # Run plugin on portscan alerts
-        self.registration = 'portscan'
+        self.registration = ['portscan']
 
         config = _load_config(CONFIG_FILE)
 
@@ -185,15 +185,17 @@ def enrich(alert, search_fn, search_window, max_connections):
         for hit in results.get('hits', [])
     ]
 
-    alert['details'] = {
-        'recentconnections': []
-    }
+    details = alert.get('details', {})
 
-    for event in take(events, max_connections):
-        alert['details']['recentconnections'].append({
+    details['recentconnections'] = [
+        {
             'destinationipaddress': event['details']['destinationipaddress'],
             'destinationport': event['details']['destinationport'],
             'timestamp': event['timestamp']
-        })
+        }
+        for event in take(events, max_connections)
+    ]
+
+    alert['details'] = details
 
     return alert
diff --git a/tests/alerts/plugins/test_port_scan_enrichment.py b/tests/alerts/plugins/test_port_scan_enrichment.py
@@ -62,7 +62,10 @@ def test_alert_enriched(self):
                         },
                     }
                 }
-            ]
+            ],
+            'details': {
+                'something': 'original'
+            }
         }
 
         search_window = {
@@ -81,3 +84,4 @@ def test_alert_enriched(self):
         assert enriched['details']['recentconnections'][0]['destinationipaddress'] in ['1.2.3.4', '4.3.2.1']
         assert enriched['details']['recentconnections'][0]['destinationport'] in [80, 443]
         assert enriched['details']['recentconnections'][0]['timestamp'] == EXAMPLE_TIMESTAMP
+        assert enriched['details']['something'] == 'original'