Skip to content

[Bug] Annotated Fields Ignored #5125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 20 commits into from
Sep 17, 2025
+8 −5
Merged

[Bug] Annotated Fields Ignored #5125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
7e12cb3
User NewType instead of Annotated
eric-forte-elastic Sep 17, 2025
91aea82
Add second bad ID
eric-forte-elastic Sep 17, 2025
5faeea1
Add ignores for marshmallow dataclass being out of date
eric-forte-elastic Sep 17, 2025
2ca1620
Max to 5
eric-forte-elastic Sep 17, 2025
2d2e50e
remove duplicate
eric-forte-elastic Sep 17, 2025
0f23487
remove another duplicate
eric-forte-elastic Sep 17, 2025
32c8e1e
remove duplicate literals
eric-forte-elastic Sep 17, 2025
dbb49ca
retain spacing
eric-forte-elastic Sep 17, 2025
98de911
Adjust spacing
eric-forte-elastic Sep 17, 2025
a5e32ca
duplicate
eric-forte-elastic Sep 17, 2025
c98024c
spacing
eric-forte-elastic Sep 17, 2025
9a8edbd
duplicate
eric-forte-elastic Sep 17, 2025
bfcc2ac
remove space
eric-forte-elastic Sep 17, 2025
fa9c6f1
Update marshmallow-dataclass
eric-forte-elastic Sep 17, 2025
c2cee73
pseudo deprecating rule for testing
eric-forte-elastic Sep 17, 2025
90c21a3
change id for testing
eric-forte-elastic Sep 17, 2025
35af7a3
remove test deprecated
eric-forte-elastic Sep 17, 2025
24e0814
Update updated date for testing
eric-forte-elastic Sep 17, 2025
c19101e
Revert testing rule and add exception
eric-forte-elastic Sep 17, 2025
3509a06
Add Note for stop gap
eric-forte-elastic Sep 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions detection_rules/schemas/definitions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,11 @@ def validator_wrapper(value: Any) -> Any:
NAME_PATTERN = re.compile(r"^[a-zA-Z0-9].+?[a-zA-Z0-9\[\]()]$")
PR_PATTERN = re.compile(r"^$|\d+$")
SHA256_PATTERN = re.compile(r"^[a-fA-F0-9]{64}$")
UUID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")

# NOTE this additional bad UUID pattern is a stop gap until the rule has been deprecated
UUID_PATTERN = re.compile(
r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" # UUID pattern
r"|^7eb54028-ca72-4eb7-8185-b6864572347db$" # Additional pattern of known bad UUID
)
_version = r"\d+\.\d+(\.\d+[\w-]*)*"
CONDITION_VERSION_PATTERN = re.compile(rf"^\^{_version}$")
VERSION_PATTERN = f"^{_version}$"
Expand Down Expand Up @@ -108,7 +111,7 @@ def validator_wrapper(value: Any) -> Any:
QUERY_FIELD_OP_EXCEPTIONS = ["powershell.file.script_block_text"]

# we had a bad rule ID make it in before tightening up the pattern, and so we have to let it bypass
KNOWN_BAD_RULE_IDS = Literal["119c8877-8613-416d-a98a-96b6664ee73a5"]
KNOWN_BAD_RULE_IDS = Literal["119c8877-8613-416d-a98a-96b6664ee73a5", "7eb54028-ca72-4eb7-8185-b6864572347db"]
KNOWN_BAD_DEPRECATED_DATES = Literal["2021-03-03"]
# Known Null values that cannot be handled in TOML due to lack of Null value support via compound dicts
KNOWN_NULL_ENTRIES = [{"rule.actions": "frequency.throttle"}]
Expand Down
4 changes: 2 additions & 2 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "detection_rules"
version = "1.4.4"
version = "1.4.5"
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
readme = "README.md"
requires-python = ">=3.12"
Expand All @@ -25,7 +25,7 @@ dependencies = [
"jsl==0.2.4",
"jsonschema>=4.21.1",
"marko==2.0.3",
"marshmallow-dataclass[union]==8.6.1",
"marshmallow-dataclass==8.7.1",
"marshmallow-jsonschema~=0.13.0",
"marshmallow-union~=0.1.15",
"marshmallow~=3.26.1",
Expand Down
Loading