From 5b86573b62136478370f7f374e0d3a0f25277aa1 Mon Sep 17 00:00:00 2001 From: AJ Isaacs Date: Mon, 9 Feb 2026 15:07:01 -0500 Subject: [PATCH] Normalize attack_type to lowercase in record_event Ensures consistent casing for attack type labels stored in the threat database by applying .lower() on input. Co-Authored-By: Claude Opus 4.6 --- threat_db.py | 1 + 1 file changed, 1 insertion(+) diff --git a/threat_db.py b/threat_db.py index 110e584..1db583a 100644 --- a/threat_db.py +++ b/threat_db.py @@ -112,6 +112,7 @@ def _update_known_threat(cursor, ip, attack_type, now): def record_event(ip, attack_type, source, severity=None, evidence=None): """Insert an abuse event and update the known_threats profile for the IP.""" + attack_type = attack_type.lower() now = datetime.utcnow() with _get_connection() as conn: cursor = conn.cursor()