diff --git a/tools/sigma/config/mapping.py b/tools/sigma/config/mapping.py index 7d337416..28ff2877 100644 --- a/tools/sigma/config/mapping.py +++ b/tools/sigma/config/mapping.py @@ -125,9 +125,9 @@ class ConditionalFieldMapping(SimpleFieldMapping): if len(targets) == 1: # result set contains only one target, return mapped item (like SimpleFieldMapping) if value is None: - return ConditionNULLValue(val=targets.pop()) + return ConditionNULLValue(val=targets[0]) else: - return (targets.pop(), value) + return (targets[0], value) elif len(targets) > 1: # result set contains multiple targets, return all linked as OR condition (like MultiFieldMapping) cond = ConditionOR() for target in targets: