-
Notifications
You must be signed in to change notification settings - Fork 588
Closed
Labels
backlogbugSomething isn't workingSomething isn't workingkqlrelated to the kql modulerelated to the kql modulepythonInternal python for the repositoryInternal python for the repository
Description
Describe the bug
Related to #2692, it appears the original query passed validation from KQLValidator
class methods when the rule was loaded. It should have failed because one of the logic operators was missing a space which is invalid for KQL.
"Test-ServiceDaclPermission" or"Update-ExeFunctions"
Testing
We should take the rule as it was before the fix locally and set a breakpoint in KQLValidator.validate
within rule_validators.py
. This should allow us to trace the parsing and validation to determine why it did not explicitly raise an error.
Metadata
Metadata
Assignees
Labels
backlogbugSomething isn't workingSomething isn't workingkqlrelated to the kql modulerelated to the kql modulepythonInternal python for the repositoryInternal python for the repository