Fix for parsing auth events

google · Sep 27, 2024 · cfda26a · cfda26a
1 parent 46b496b
commit cfda26a
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/timesketch/lib/analyzers/authentication/utils.py b/timesketch/lib/analyzers/authentication/utils.py
@@ -593,7 +593,10 @@ def get_login_record(
 
         try:
             login_timestamp = int(login_df.iloc[0]["timestamp"])
-            source_port = int(login_df.iloc[0]["source_port"])
+            if login_df.iloc[0]["source_port"] == "-":
+                source_port = 0
+            else:
+                source_port = int(login_df.iloc[0]["source_port"])
         except (IndexError, KeyError) as e:
             log.debug("Unable to get login_timestamp or source_port. %s", str(e))
             return None