add file/host state to msft graph alert context (#1220)

panther-labs · Apr 24, 2024 · 8e072a6 · 8e072a6
1 parent e2e9b4f
commit 8e072a6
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/global_helpers/panther_base_helpers.py b/global_helpers/panther_base_helpers.py
@@ -473,7 +473,9 @@ def msft_graph_alert_context(event):
     return {
         "category": event.get("category", ""),
         "description": event.get("description", ""),
-        "userstates": event.get("userstates", []),
+        "userStates": event.get("userStates", []),
+        "fileStates": event.get("fileStates", []),
+        "hostStates": event.get("hostStates", []),
     }