From 39ce4ae502c1c7041c428ba20112d6db1e08de8d Mon Sep 17 00:00:00 2001
From: Ben Airey <ben.airey@panther.com>
Date: Thu, 7 Nov 2024 10:24:54 -0600
Subject: [PATCH] refactor `actor_user` function to use imported `deep_get`

---
 global_helpers/panther_azuresignin_helpers.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/global_helpers/panther_azuresignin_helpers.py b/global_helpers/panther_azuresignin_helpers.py
index 3058f63fc..049623c6a 100644
--- a/global_helpers/panther_azuresignin_helpers.py
+++ b/global_helpers/panther_azuresignin_helpers.py
@@ -1,9 +1,14 @@
+from panther_base_helpers import deep_get
+
+
 def actor_user(event):
+    # 'event' could be a PantherEvent or an ImmutableCaseInsensitiveDict, so we have to use the
+    #   imported deep_get method.
     category = event.get("category", "")
     if category in {"ServicePrincipalSignInLogs"}:
-        return event.deep_get("properties", "servicePrincipalName")
+        return deep_get(event, "properties", "servicePrincipalName")
     if category in {"SignInLogs", "NonInteractiveUserSignInLogs"}:
-        return event.deep_get("properties", "userPrincipalName")
+        return deep_get(event, "properties", "userPrincipalName")
     return None