'severity' function now falls back to "DEFAULT"

panther-labs · Dec 4, 2024 · 3113297 · 3113297
1 parent 914ad2f
commit 3113297
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/crowdstrike_rules/event_stream_rules/crowdstrike_detection_summary.py b/rules/crowdstrike_rules/event_stream_rules/crowdstrike_detection_summary.py
@@ -30,7 +30,7 @@ def severity(event):
     # Else, fallback on the numerical value, falling back on MEDIUM if we still don't have a value
     sevval = event.deep_get("event", "Severity") // 20
     return {0: "INFO", 1: "LOW", 2: "MEDIUM", 3: "HIGH", 4: "CRITICAL", 5: "CRITICAL"}.get(
-        sevval, "MEDIUM"
+        sevval, "DEFAULT"
     )