[Rule Tuning] ESQL Query Field Dynamic Field Standardization #4912
+2,421
−1,303
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…gle User Over a Session
…gle User Over a Session
…ithin a Single Blocked Request
terrancedejesus
requested review from
Mikaayenson,
DefSecSentinel,
imays11,
Aegrah,
shashank-elastic and
eric-forte-elastic
botelastic
bot
added
bbr
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
Mikaayenson
reviewed
Jul 25, 2025
| | sort violations desc | ||
|
|
||
| // Keep relevant ECS + model fields | ||
| | keep |
There was a problem hiding this comment.
Any reason we're mixing case for ES|QL functions? FROM vs keep vs stats vs COUNT
There was a problem hiding this comment.
Not only the processing functions or commands, but logical operators can be lowercase or uppercase. There is variation amongst ESQL rules based on personal preference of the rule author. Since there are no inherit downsides, best practice against or for - I'd suggest leaving these as-is.
There was a problem hiding this comment.
Im just not sure if it's best. It's really a nit, but seeing them mixed when we're already touching all the rules appears odd.
Mikaayenson
reviewed
Jul 25, 2025
| // Aggregate all violation types per user | ||
| | stats | ||
| Esql.ml_policy_blocked_violation_total_count = SUM(Esql.ml_policy_blocked_violation_count) | ||
| by |
There was a problem hiding this comment.
nit: I think single line is easier to read, but im assuming its just really long now.
Mikaayenson
approved these changes
Jul 25, 2025
Aegrah
approved these changes
Jul 29, 2025
| process.args IN ("-d", "-base64", "-a") | ||
| ) OR | ||
| ( | ||
| process.name RLIKE "^python.*" AND ( |
There was a problem hiding this comment.
Why was this modified to RLIKE?
| ) | ||
| ) OR | ||
| ( | ||
| process.name RLIKE "^perl.*" AND |
| process.command_line LIKE "*decode_base64*" | ||
| ) OR | ||
| ( | ||
| process.name RLIKE "^ruby.*" AND |
Comment on lines
+108
to
+109
| host.name.values = VALUES(host.name), | ||
| agent.id.values = VALUES(agent.id) |
There was a problem hiding this comment.
These two don't need an Esql. prefix?
Comment on lines
+107
to
+108
| host.name.values = VALUES(host.name), | ||
| agent.id.values = VALUES(agent.id) |
Comment on lines
+120
to
+121
| host.name.values = VALUES(host.name), | ||
| agent.id.values = VALUES(agent.id) |
Comment on lines
+142
to
+143
| host.name.values = VALUES(host.name), | ||
| agent.id.values = VALUES(agent.id) |
Comment on lines
+152
to
+153
| host.name.values = VALUES(host.name), | ||
| agent.id.values = VALUES(agent.id) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request
Issue link(s):
Summary - What I changed
Adjusts all ESQL queries in detection rules to standard field names based on previously established guidelines. Please see related issue and other related issues for more details.
How To Test
Almost all queries have been tested in the TRADE serverless stack to confirm logic was not adjusted unintentionally. It is recommended that anyone reviewing - if a query was written by them to test it on their own dataset to ensure logic has not changed.
Checklist
bug,enhancement,schema,maintenance,Rule: New,Rule: Deprecation,Rule: Tuning,Hunt: New, orHunt: Tuningso guidelines can be generatedmeta:rapid-mergelabel if planning to merge within 24 hoursContributor checklist