Skip to content

Commit 2ee3f67

Browse files
Ignore Kibana long vs schema integer mismatch
1 parent 2aaeae6 commit 2ee3f67

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

detection_rules/rule_validators.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -791,6 +791,11 @@ def validate_columns_index_mapping(
791791
schema_type = utils.get_column_from_index_mapping_schema(keys, combined_mappings)
792792
schema_type = kql.parser.elasticsearch_type_family(schema_type) if schema_type else None
793793

794+
# The mapping between integer and long may be different between Kibana and the schema
795+
# both are numeric types with different ranges, but for our purposes they are equivalent
796+
if column_type == "long" and schema_type == "integer":
797+
continue
798+
794799
# Validate the type
795800
if not schema_type or column_type != schema_type:
796801
mismatched_columns.append(

0 commit comments

Comments
 (0)