Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] Missing Spaces Between Logic Operators Does Not Raise Error #2700

Open
terrancedejesus opened this issue Apr 5, 2023 · 1 comment · May be fixed by #3789
Open

[Bug] Missing Spaces Between Logic Operators Does Not Raise Error #2700

terrancedejesus opened this issue Apr 5, 2023 · 1 comment · May be fixed by #3789
Assignees
@eric-forte-elastic
Labels
backlog bug Something isn't working kql related to the kql module python Internal python for the repository

Comments

@terrancedejesus
Copy link
Contributor

Describe the bug

Related to #2692, it appears the original query passed validation from KQLValidator class methods when the rule was loaded. It should have failed because one of the logic operators was missing a space which is invalid for KQL.

"Test-ServiceDaclPermission" or"Update-ExeFunctions"

Testing

We should take the rule as it was before the fix locally and set a breakpoint in KQLValidator.validate within rule_validators.py. This should allow us to trace the parsing and validation to determine why it did not explicitly raise an error.
@terrancedejesus terrancedejesus added the bug Something isn't working label Apr 5, 2023
@terrancedejesus terrancedejesus self-assigned this Apr 5, 2023
@terrancedejesus terrancedejesus added python Internal python for the repository backlog labels Apr 5, 2023
@terrancedejesus terrancedejesus mentioned this issue Apr 5, 2023
Merged
@Mikaayenson Mikaayenson added the kql related to the kql module label Jun 12, 2024
@Mikaayenson
Copy link
Contributor

@eric-forte-elastic can you link a PR if you created one for this already?

@eric-forte-elastic eric-forte-elastic linked a pull request Jun 14, 2024 that will close this issue
[FR] Add white space checking for KQL parse #3789
Draft
@eric-forte-elastic eric-forte-elastic linked a pull request Jun 14, 2024 that will close this issue
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@eric-forte-elastic eric-forte-elastic

Labels
backlog bug Something isn't working kql related to the kql module python Internal python for the repository
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[FR] Add white space checking for KQL parse elastic/detection-rules
3 participants
@Mikaayenson @terrancedejesus @eric-forte-elastic