diff --git a/bbot/modules/internal/excavate.py b/bbot/modules/internal/excavate.py index bc777e66c..5594c72bd 100644 --- a/bbot/modules/internal/excavate.py +++ b/bbot/modules/internal/excavate.py @@ -274,8 +274,9 @@ async def process(self, yara_results, event, yara_rule_settings, discovery_conte description_string = ( f" with description: [{yara_rule_settings.description}]" if yara_rule_settings.description else "" ) + url_string = event.data.get("url") or event.data.get("host", "Unknown Source") event_data["description"] = ( - f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}]" + f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}] on [{url_string}]" ) if yara_rule_settings.emit_match: event_data["description"] += f" and extracted [{result}]"