We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent f4b5088 commit 594f58fCopy full SHA for 594f58f
detection_rules/rule_validators.py
@@ -661,6 +661,9 @@ def validate_query_text_with_schema( # noqa: PLR0913
661
# If the error is an unknown field and the field was referenced as optional (prefixed with '?'),
662
# treat this target as non-fatal to honor EQL optional semantics.
663
664
+ # To support EQL sequence and sub query validation we need to return this field to overwrite
665
+ # what would have been parsed via auto_add_field as the error message and query may be our of sync
666
+ # depending on how the method is called.
667
field = extract_error_field(query_text, exc)
668
if (
669
field
0 commit comments