[Bug] Reject ES-incompatible field comparisons under elasticsearch_syntax - #86
Merged
Merged
Conversation
…ntax Match Elasticsearch EQL by rejecting field-to-field comparisons and field arithmetic in ==/!=/</> when elasticsearch_syntax is enabled, so SIEM CI catches invalid queries (e.g. length(a) == length(b) - 1) before ship.
Mikaayenson
commented
Aug 6, 2026
Extract validation into a helper to reduce comparison() complexity and wrap a long assertRaises line.
Cite ES EQL docs and the observed runtime rejection instead.
Mikaayenson
added
bug
Endpoint EQL allows field-to-field comparisons; gate the check via reject_field_comparisons so elastic_endpoint_syntax is unaffected.
Match ES: comparisons need one constant side. length(a)-1 == 5 is valid; length(a) == length(b)-1 is not. Thanks Eric for the patch.
eric-forte-elastic
approved these changes
Aug 6, 2026
eric-forte-elastic
left a comment
eric-forte-elastic
left a comment
Collaborator
There was a problem hiding this comment.
Two suggestions, otherwise I think this looks good 👍
Pass offender/op as _error kwargs so brace literals raise EqlSemanticError, and cover alias exemptions under reject_field_comparisons.
Mikaayenson
commented
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
elasticsearch_syntax/reject_field_comparisons, reject comparisons where neither side folds to a constant (field-to-field), including through functions and arithmetic (e.g.a == b,length(a) == length(b) - 1).length(a) - 1 == 5), matching Elasticsearch stack behavior.elastic_endpoint_syntax(Endpoint allows field-to-field comparisons). Sequence aliases (as p0) remain allowed when aliases are enabled.Comparisons against fields are not currently supported) (detection-rules#6611).Test plan
flake8 eql testspytest tests/locally (616 passed)8.19/9.3/9.4/9.5: only NTLM field-vs-field fails (expected); fixed branch parses cleanmain: 1936/1936 OK