[fix] Preserve actions[].params.message field formatting during rule export from the repo (#5597)

* Preserve `message` field formatting

* Note the JSON path explicitely in the comment

* version bump fix

(cherry picked from commit 5b092d7831)

detection_rules/rule_formatter.py

@@ -24,6 +24,12 @@ DQ = '"'
 TRIPLE_SQ = SQ * 3
 TRIPLE_DQ = DQ * 3
 
+# Fields from nested objects (not BaseRuleData fields) that need to be perserved.
+# NOTE: we treat these as globally unique which might not be true in all cases
+# Excluded fields:
+# - actions[].params.message
+NESTED_PRESERVED_FIELD_NAMES: set[str] = {"message"}
+
 
 @cached
 def get_preserved_fmt_fields() -> set[str]:
@@ -34,6 +40,9 @@ def get_preserved_fmt_fields() -> set[str]:
     for field in dataclasses.fields(BaseRuleData):
         if field.type in (definitions.Markdown, definitions.Markdown | None):
             preserved_keys.add(field.metadata.get("data_key", field.name))
+
+    preserved_keys.update(NESTED_PRESERVED_FIELD_NAMES)
+
     return preserved_keys
 
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.5.30"
+version = "1.5.31"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"