diff --git a/threat_db.py b/threat_db.py
index 110e584..1db583a 100644
--- a/threat_db.py
+++ b/threat_db.py
@@ -112,6 +112,7 @@ def _update_known_threat(cursor, ip, attack_type, now):
 
 def record_event(ip, attack_type, source, severity=None, evidence=None):
     """Insert an abuse event and update the known_threats profile for the IP."""
+    attack_type = attack_type.lower()
     now = datetime.utcnow()
     with _get_connection() as conn:
         cursor = conn.cursor()