security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FR] Skip eql optimizations on parsing query for unique fields (#3443)

Browse Source 
(cherry picked from commit 542053719b)
This commit is contained in:
Mika Ayenson
2024-02-20 20:25:51 -06:00
committed by github-actions[bot]
parent c772b2a842
commit 2312455d7a
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/rule.py
+2 -2
View File
@@ -1358,8 +1358,8 @@ def get_unique_query_fields(rule: TOMLRule) -> List[str]:
if language in ('kuery', 'eql'):
# TODO: remove once py-eql supports ipv6 for cidrmatch
config = set_eql_config(rule.contents.metadata.get('min_stack_version'))
with eql.parser.elasticsearch_syntax, eql.parser.ignore_missing_functions, config:
cfg = set_eql_config(rule.contents.metadata.get('min_stack_version'))
with eql.parser.elasticsearch_syntax, eql.parser.ignore_missing_functions, eql.parser.skip_optimizations, cfg:
parsed = kql.parse(query) if language == 'kuery' else eql.parse_query(query)
return sorted(set(str(f) for f in parsed if isinstance(f, (eql.ast.Field, kql.ast.Field))))
detection_rules/rule_validators.py
+2 -2
View File
@@ -207,8 +207,8 @@ class EQLValidator(QueryValidator):
@cached_property
def ast(self) -> eql.ast.Expression:
latest_version = Version.parse(load_current_package_version(), optional_minor_and_patch=True)
config = set_eql_config(str(latest_version))
with eql.parser.elasticsearch_syntax, eql.parser.ignore_missing_functions, config:
cfg = set_eql_config(str(latest_version))
with eql.parser.elasticsearch_syntax, eql.parser.ignore_missing_functions, eql.parser.skip_optimizations, cfg:
return eql.parse_query(self.query)
def text_fields(self, eql_schema: Union[ecs.KqlSchema2Eql, endgame.EndgameSchema]) -> List[str]: