Merge pull request #199 from kaanekici/fix-dfe-username-missing-bug

Fix missing username for defender for endpoint query
redcanaryco · Feb 13, 2025 · 11a17cd · 11a17cd
2 parents 993a146 + 95e24d2
commit 11a17cd
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/products/microsoft_defender_for_endpoints.py b/products/microsoft_defender_for_endpoints.py
@@ -130,8 +130,10 @@ def _post_advanced_query(self, data: dict, headers: dict) -> list[Result]:
                         raw_results.append(res)
                     '''
                     hostname = res['DeviceName'] if 'DeviceName' in res else 'Unknown'
+
                     if 'AccountName' in res or 'InitiatingProcessAccountName' in res:
                         username = res['AccountName'] if 'AccountName' in res else res['InitiatingProcessAccountName']
+                    else:
                         username = 'Unknown'
 
                     if 'ProcessCommandLine' in res or 'InitiatingProcessCommandLine' in res: