We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 85fcbc9 commit 6583002Copy full SHA for 6583002
detection_rules/index_mappings.py
@@ -289,8 +289,11 @@ def get_filtered_index_schema(
289
filtered_index_lookup.update(custom_mapping)
290
291
# Reduce the combined mappings to only the matched indices (local schema validation source of truth)
292
+ # Custom and non-ecs mappings are filtered before being sent to this function in prepare mappings
293
combined_mappings: dict[str, Any] = {}
294
utils.combine_dicts(combined_mappings, deepcopy(ecs_schema))
295
+ utils.combine_dicts(combined_mappings, deepcopy(non_ecs_mapping))
296
+ utils.combine_dicts(combined_mappings, deepcopy(custom_mapping))
297
for match in matches:
298
utils.combine_dicts(combined_mappings, deepcopy(filtered_index_lookup.get(match, {})))
299
0 commit comments