diff --git a/global_helpers/panther_azuresignin_helpers.py b/global_helpers/panther_azuresignin_helpers.py index 3058f63fc..049623c6a 100644 --- a/global_helpers/panther_azuresignin_helpers.py +++ b/global_helpers/panther_azuresignin_helpers.py @@ -1,9 +1,14 @@ +from panther_base_helpers import deep_get + + def actor_user(event): + # 'event' could be a PantherEvent or an ImmutableCaseInsensitiveDict, so we have to use the + # imported deep_get method. category = event.get("category", "") if category in {"ServicePrincipalSignInLogs"}: - return event.deep_get("properties", "servicePrincipalName") + return deep_get(event, "properties", "servicePrincipalName") if category in {"SignInLogs", "NonInteractiveUserSignInLogs"}: - return event.deep_get("properties", "userPrincipalName") + return deep_get(event, "properties", "userPrincipalName") return None