Mika Ayenson
1f015ebe85
* Ensure kql2eql conversion doesnt support `text` fields * Add unit test cases for`text` not supported in eql * test `field not recognized` in the rule_validator and output a verbose message. * use elasticsearch_type_family to lookup text mappings Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
107 lines
3.6 KiB
Python
Executable File
107 lines
3.6 KiB
Python
Executable File
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
# or more contributor license agreements. Licensed under the Elastic License
|
|
# 2.0; you may not use this file except in compliance with the Elastic License
|
|
# 2.0.
|
|
|
|
import eql
|
|
|
|
from .parser import BaseKqlParser
|
|
|
|
NOT_SUPPORTED_EQL_FIELDS = ["text"]
|
|
# https://github.com/elastic/eql/issues/17
|
|
|
|
class KqlToEQL(BaseKqlParser):
|
|
|
|
#
|
|
# Lark Visit methods
|
|
#
|
|
@staticmethod
|
|
def to_eql_field(name):
|
|
path = name.split(".")
|
|
return eql.ast.Field(path[0], path[1:])
|
|
|
|
def or_query(self, tree):
|
|
terms = [self.visit(t) for t in tree.child_trees]
|
|
return eql.ast.Or(terms)
|
|
|
|
def and_query(self, tree):
|
|
terms = [self.visit(t) for t in tree.child_trees]
|
|
return eql.ast.And(terms)
|
|
|
|
def not_query(self, tree):
|
|
return eql.ast.Not(self.visit(tree.children[-1]))
|
|
|
|
def nested_query(self, tree):
|
|
raise self.error(tree, "Unable to convert nested query to EQL")
|
|
|
|
def field_range_expression(self, tree):
|
|
field_tree, operator, literal_tree = tree.children
|
|
field_name = self.visit(field_tree)
|
|
|
|
# check the field against the schema
|
|
self.get_field_type(field_name, field_tree)
|
|
|
|
# get and convert the value
|
|
value = self.convert_value(field_name, self.visit(literal_tree), literal_tree)
|
|
literal = eql.ast.Literal.from_python(value)
|
|
|
|
field = self.to_eql_field(field_name)
|
|
return eql.ast.Comparison(field, operator.value, literal)
|
|
|
|
def field_value_expression(self, tree):
|
|
field_tree, value_tree = tree.child_trees
|
|
|
|
with self.scope(self.visit(field_tree)) as field_name:
|
|
# check the field against the schema
|
|
|
|
type_mapping = self.get_field_type(field_name, field_tree)
|
|
if type_mapping in NOT_SUPPORTED_EQL_FIELDS:
|
|
err_msg = f"{field_name} uses an unsupported elasticsearch eql field_type {type_mapping}"
|
|
raise eql.EqlSemanticError(err_msg, field_tree.line, field_tree.column, self.text)
|
|
|
|
return self.visit(value_tree)
|
|
|
|
def or_list_of_values(self, tree):
|
|
children = [self.visit(t) for t in tree.child_trees]
|
|
return eql.ast.Or(children)
|
|
|
|
def and_list_of_values(self, tree):
|
|
children = [self.visit(t) for t in tree.child_trees]
|
|
return eql.ast.And(children)
|
|
|
|
def not_list_of_values(self, tree):
|
|
return eql.ast.Not(self.visit(tree.children[-1]))
|
|
|
|
def field(self, tree):
|
|
literal = self.visit(tree.children[0])
|
|
return eql.utils.to_unicode(literal)
|
|
|
|
def value(self, tree):
|
|
# TODO: check the logic for kuery.peg
|
|
value = self.unescape_literal(tree.children[0])
|
|
|
|
if self.scoped_field is None:
|
|
raise self.error(tree, "Value not tied to field")
|
|
|
|
field_name = self.scoped_field
|
|
field = self.to_eql_field(field_name)
|
|
value = self.convert_value(field_name, value, tree)
|
|
value_ast = eql.ast.Literal.from_python(value)
|
|
|
|
if value is None:
|
|
return eql.ast.IsNull(field)
|
|
|
|
if eql.utils.is_string(value) and value.replace("*", "") == "":
|
|
return eql.ast.IsNotNull(field)
|
|
|
|
if eql.utils.is_string(value) and "*" in value:
|
|
return eql.ast.FunctionCall("wildcard", [field, value_ast])
|
|
|
|
if self.get_field_types(field_name) == {"ip"} and "/" in value:
|
|
return eql.ast.FunctionCall("cidrMatch", [field, value_ast])
|
|
|
|
return eql.ast.Comparison(field, "==", value_ast)
|
|
|
|
def literal(self, tree):
|
|
return self.unescape_literal(tree.children[0])
|