Skip to content

Commit 594f58f

Browse files
Add comment explaining change
1 parent f4b5088 commit 594f58f

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

detection_rules/rule_validators.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -661,6 +661,9 @@ def validate_query_text_with_schema( # noqa: PLR0913
661661
# If the error is an unknown field and the field was referenced as optional (prefixed with '?'),
662662
# treat this target as non-fatal to honor EQL optional semantics.
663663

664+
# To support EQL sequence and sub query validation we need to return this field to overwrite
665+
# what would have been parsed via auto_add_field as the error message and query may be our of sync
666+
# depending on how the method is called.
664667
field = extract_error_field(query_text, exc)
665668
if (
666669
field

0 commit comments

Comments
 (0)