THREAT-397 lint fix

panther-labs · Oct 3, 2024 · ee484ed · ee484ed
1 parent 917e905
commit ee484ed
Show file tree

Hide file tree

Showing 7 changed files with 9 additions and 16 deletions.
diff --git a/global_helpers/global_helpers_test.py b/global_helpers/global_helpers_test.py
@@ -1914,7 +1914,9 @@ def test_alert_context(self):
         self.assertEqual(returns.get("action", ""), "CREATE")
         self.assertEqual(tailscale_admin_console_event, True)
         returns = p_tscale_h.tailscale_alert_context(PantherEvent({}))
-        tailscale_admin_console_event = p_tscale_h.is_tailscale_admin_console_event(PantherEvent({}))
+        tailscale_admin_console_event = p_tscale_h.is_tailscale_admin_console_event(
+            PantherEvent({})
+        )
         self.assertEqual(returns.get("actor", ""), "<NO_ACTOR_FOUND>")
         self.assertEqual(returns.get("action", ""), "<NO_ACTION_FOUND>")
         self.assertEqual(tailscale_admin_console_event, False)

diff --git a/queries/crowdstrike_queries/aws_authentication_from_crowdstrike_unmanaged_device.py b/queries/crowdstrike_queries/aws_authentication_from_crowdstrike_unmanaged_device.py
@@ -1,4 +1,4 @@
-from panther_base_helpers import aws_rule_context, deep_get
+from panther_base_helpers import aws_rule_context
 
 
 def rule(_):

diff --git a/rules/aws_cloudtrail_rules/aws_console_login_without_mfa.py b/rules/aws_cloudtrail_rules/aws_console_login_without_mfa.py
@@ -82,8 +82,8 @@ def title(event):
     if event.deep_get("userIdentity", "type") == "Root":
         user_string = "the root user"
     else:
-        user = event.deep_get("userIdentity", "userName") or deep_get(
-            event, "userIdentity", "sessionContext", "sessionIssuer", "userName"
+        user = event.deep_get("userIdentity", "userName") or event.deep_get(
+            "userIdentity", "sessionContext", "sessionIssuer", "userName"
         )
         type_ = event.deep_get(
             "userIdentity", "sessionContext", "sessionIssuer", "type", default="user"

diff --git a/rules/gcp_audit_rules/gcp_permissions_granted_to_create_or_manage_service_account_key.py b/rules/gcp_audit_rules/gcp_permissions_granted_to_create_or_manage_service_account_key.py
@@ -1,5 +1,3 @@
-from panther_base_helpers import deep_walk
-
 SERVICE_ACCOUNT_MANAGE_ROLES = [
     "roles/iam.serviceAccountTokenCreator",
     "roles/iam.serviceAccountUser",

diff --git a/rules/gcp_audit_rules/gcp_workforce_pool_created_or_updated.py b/rules/gcp_audit_rules/gcp_workforce_pool_created_or_updated.py
@@ -16,9 +16,7 @@ def title(event):
         "protoPayload", "request", "workforcePool", "name", default=""
     ).split("/")[-1]
 
-    resource = organization_id = event.get("logName", "<LOG_NAME_NOT_FOUND>").split(
-        "/"
-    )
+    resource = organization_id = event.get("logName", "<LOG_NAME_NOT_FOUND>").split("/")
 
     organization_id = resource[resource.index("organizations") + 1]
 

diff --git a/rules/tines_rules/tines_global_resource_destruction.py b/rules/tines_rules/tines_global_resource_destruction.py
@@ -6,10 +6,7 @@ def rule(event):
     if not filter_include_event(event):
         return False
 
-    return (
-        event.get("operation_name", "<NO_OPERATION_NAME>")
-        == "GlobalResourceDestruction"
-    )
+    return event.get("operation_name", "<NO_OPERATION_NAME>") == "GlobalResourceDestruction"
 
 
 def title(event):

diff --git a/rules/tines_rules/tines_story_items_destruction.py b/rules/tines_rules/tines_story_items_destruction.py
@@ -6,9 +6,7 @@ def rule(event):
     if not filter_include_event(event):
         return False
 
-    return (
-        event.get("operation_name", "<NO_OPERATION_NAME>") == "StoryItemsDestruction"
-    )
+    return event.get("operation_name", "<NO_OPERATION_NAME>") == "StoryItemsDestruction"
 
 
 def title(event):