refactor excavate finding description

blacklanternsecurity · Nov 8, 2024 · c73af0e · c73af0e
1 parent 3d7dee3
commit c73af0e
Showing 1 changed file with 3 additions and 4 deletions.
diff --git a/bbot/modules/internal/excavate.py b/bbot/modules/internal/excavate.py
@@ -274,12 +274,11 @@ async def process(self, yara_results, event, yara_rule_settings, discovery_conte
                 description_string = (
                     f" with description: [{yara_rule_settings.description}]" if yara_rule_settings.description else ""
                 )
-                # Get URL from event if available
-                url = event.data.get("url", "") if hasattr(event, "data") else ""
-                url_string = f" on @{url}" if url else ""
+
+                url_string = event.data.get("url") or event.data.get("host", "Unknown Source")
 
                 event_data["description"] = (
-                    f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}]{url_string}"
+                    f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}] on [{url_string}]"
                 )
                 if yara_rule_settings.emit_match:
                     event_data["description"] += f" and extracted [{result}]"