From 66c1d7f3b4355cefb110166fc9c5b2f5584f53ea Mon Sep 17 00:00:00 2001
From: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
Date: Tue, 14 Nov 2023 23:06:04 -0500
Subject: [PATCH] [Bug] Fix typo in downgrade_contents_from_rule (#3272)

* Fix missing to_dict()

* Update pyproject.toml
---
 detection_rules/rule.py | 8 ++++++--
 pyproject.toml          | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/detection_rules/rule.py b/detection_rules/rule.py
index f02254934..1eaf485b4 100644
--- a/detection_rules/rule.py
+++ b/detection_rules/rule.py
@@ -1290,8 +1290,12 @@ def downgrade_contents_from_rule(rule: TOMLRule, target_version: str, replace_id
 
     rule_dict = downgrade(rule_dict, target_version=str(min_stack_version))
     meta = rule_dict.pop("meta")
-    rule_contents = TOMLRuleContents.from_dict({"rule": rule_dict, "metadata": meta,
-                                                "transform": rule.contents.transform})
+    rule_contents_dict = {"rule": rule_dict, "metadata": meta}
+
+    if rule.contents.transform:
+        rule_contents_dict["transform"] = rule.contents.transform.to_dict()
+
+    rule_contents = TOMLRuleContents.from_dict(rule_contents_dict)
     payload = rule_contents.to_api_format()
     payload = strip_non_public_fields(min_stack_version, payload)
     return payload
diff --git a/pyproject.toml b/pyproject.toml
index 8a5ad2dfe..bf5ec9f58 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -26,7 +26,7 @@ dependencies = [
 	"elasticsearch~=8.1",
 	"eql==0.9.19",
 	"jsl==0.2.4",
-	"jsonschema==3.2.0",
+	"jsonschema>=3.2.0",
 	"marko==2.0.1",
 	"marshmallow-dataclass[union]~=8.5.12",
 	"marshmallow-jsonschema~=0.12.0",