Get parsed IRC sessions (DPI) observed on the wire.
()
| 17088 | original.get('timestamp') |
| 17089 | or original.get('last_seen') |
| 17090 | or default_last_update |
| 17091 | ) |
| 17092 | |
| 17093 | attribution = None |
| 17094 | if enriched_finding.attribution and enriched_finding.attribution.actor_name: |
| 17095 | confidence = enriched_finding.attribution.confidence |
| 17096 | if confidence: |
| 17097 | attribution = f"{enriched_finding.attribution.actor_name} ({int(round(confidence * 100))}% confidence)" |
| 17098 | else: |
| 17099 | attribution = enriched_finding.attribution.actor_name |
| 17100 | |
| 17101 | summary = (enriched_finding.executive_summary or '').strip() |
| 17102 | if summary and len(summary) > 160: |
| 17103 | summary = summary[:157] + '...' |
| 17104 | |
| 17105 | risk_score = int(round(min(enriched_finding.dynamic_risk_score or 0.0, 10.0) * 10)) |
| 17106 | |
| 17107 | return { |
| 17108 | 'id': finding_id, |
nothing calls this directly
no test coverage detected