Update eql/functions.py

Co-authored-by: Justin Ibarra <[email protected]>
endgameinc · Oct 26, 2023 · 1d1f763 · 1d1f763
1 parent 998de35
commit 1d1f763
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/eql/functions.py b/eql/functions.py
@@ -260,8 +260,9 @@ def expand_ipv6_address(cls, ipv6_address):
             right_groups = right.split(":")
             num_left_groups = len(left_groups)
             num_right_groups = len(right_groups)
+            max_groups = 8
             # Calculate the number of groups in the middle part
-            num_middle_groups = 8 - num_left_groups - num_right_groups
+            num_middle_groups = max_groups - num_left_groups - num_right_groups
             # Construct the full notation address
             middle_groups = ["0000"] * num_middle_groups
             full_groups = left_groups + middle_groups + right_groups