get_mitre_report with format='json' returns a raw JSON string, not a parsed Python object. FalconPy's GetMitreReport returns bytes for both CSV and JSON formats. The current code does response.decode('utf-8') which gives the caller a string they'd need to json.loads() themselves.
The return type annotation says list[dict[str, Any]] | str implying JSON format returns parsed dicts, but it actually returns a string in both cases.
Verified against the live API — JSON format comes back as bytes containing a JSON array (e.g., [{"id": "...", "tactic_id": "...", ...}]). Some actors return b'null' when they have no MITRE mappings, which would need handling too.
To fix: add a json.loads() call on the decoded string when format='json', handle the null case, and keep the raw string return for CSV.
get_mitre_reportwithformat='json'returns a raw JSON string, not a parsed Python object. FalconPy'sGetMitreReportreturnsbytesfor both CSV and JSON formats. The current code doesresponse.decode('utf-8')which gives the caller a string they'd need tojson.loads()themselves.The return type annotation says
list[dict[str, Any]] | strimplying JSON format returns parsed dicts, but it actually returns a string in both cases.Verified against the live API — JSON format comes back as bytes containing a JSON array (e.g.,
[{"id": "...", "tactic_id": "...", ...}]). Some actors returnb'null'when they have no MITRE mappings, which would need handling too.To fix: add a
json.loads()call on the decoded string whenformat='json', handle thenullcase, and keep the raw string return for CSV.