Skip to content

[7.9] [SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ), ", * (#74003) #74033

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Aug 1, 2020
Merged

[7.9] [SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ), ", * (#74003) #74033

merged 1 commit into from
Aug 1, 2020

Conversation

@FrankHassanabad
Copy link
Contributor

@FrankHassanabad FrankHassanabad commented Aug 1, 2020

Backports the following commits to 7.9:

@FrankHassanabad
[SIEM][Detection Engine] Fixes tags to accept characters such as AND,…
2ff7bd1 
… OR, (, ), ", * (elastic#74003)

## Summary

If you create a rule with tags that have an AND, OR, (, ), etc... then you would blow up with an error when you try to filter based off of that like the screen shot below:
<img width="703" alt="Screen Shot 2020-07-31 at 1 55 31 PM" src="https://user-images.githubusercontent.com/1151048/89075547-b3206f80-d33b-11ea-9e7a-30d4a49ac1de.png">

Now you don't blow up:
<img width="1708" alt="Screen Shot 2020-07-31 at 2 37 11 PM" src="https://user-images.githubusercontent.com/1151048/89075553-b582c980-d33b-11ea-807a-7d6a1d1921e8.png">

This fixes it by adding double quotes around the filters and also red/green/TDD unit tests where I first exercised the error conditions then fixed them.   

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
@FrankHassanabad FrankHassanabad added the backport This PR is a backport of another PR label Aug 1, 2020
@kibanamachine
Copy link
Contributor

kibanamachine commented Aug 1, 2020

💚 Build Succeeded

Build metrics

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@FrankHassanabad FrankHassanabad merged commit ec583ce into elastic:7.9 Aug 1, 2020
@FrankHassanabad FrankHassanabad deleted the backport/7.9/pr-74003 branch August 1, 2020 02:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

backport This PR is a backport of another PR

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@FrankHassanabad @kibanamachine