Merge pull request #85 from splunk/ba_sourctype_drilldown

[TR-3481] Sourcetype output
splunk · Nov 28, 2023 · dc23f1b · dc23f1b
2 parents 2f2e84a + 629b009
commit dc23f1b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/contentctl/output/finding_report_writer.py b/contentctl/output/finding_report_writer.py
@@ -63,7 +63,7 @@ def writeFindingReport(detection : SSADetection) -> None:
             evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_")
             if not i == (len(detection.tags.observable) - 1):
                 evidence_str = evidence_str + ', '
-        evidence_str = evidence_str + '}'        
+        evidence_str = evidence_str + '", sourceType": metadata.source_type}'        
 
         detection.tags.evidence_str = evidence_str