From b5a42e50f7fab9393a341fa082d70468a14a254d Mon Sep 17 00:00:00 2001 From: Sergey Polzunov Date: Mon, 26 Jan 2026 13:04:36 +0100 Subject: [PATCH] [fix] Preserve `actions[].params.message` field formatting during rule export from the repo (#5597) * Preserve `message` field formatting * Note the JSON path explicitely in the comment * version bump fix (cherry picked from commit 5b092d7831eb7b4ca13260dd6e97f3e5c34c2432) --- detection_rules/rule_formatter.py | 9 +++++++++ pyproject.toml | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/detection_rules/rule_formatter.py b/detection_rules/rule_formatter.py index 46469f24d..cea3d8b0a 100644 --- a/detection_rules/rule_formatter.py +++ b/detection_rules/rule_formatter.py @@ -24,6 +24,12 @@ DQ = '"' TRIPLE_SQ = SQ * 3 TRIPLE_DQ = DQ * 3 +# Fields from nested objects (not BaseRuleData fields) that need to be perserved. +# NOTE: we treat these as globally unique which might not be true in all cases +# Excluded fields: +# - actions[].params.message +NESTED_PRESERVED_FIELD_NAMES: set[str] = {"message"} + @cached def get_preserved_fmt_fields() -> set[str]: @@ -34,6 +40,9 @@ def get_preserved_fmt_fields() -> set[str]: for field in dataclasses.fields(BaseRuleData): if field.type in (definitions.Markdown, definitions.Markdown | None): preserved_keys.add(field.metadata.get("data_key", field.name)) + + preserved_keys.update(NESTED_PRESERVED_FIELD_NAMES) + return preserved_keys diff --git a/pyproject.toml b/pyproject.toml index a28439ef4..0832c3dd3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "detection_rules" -version = "1.5.30" +version = "1.5.31" description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine." readme = "README.md" requires-python = ">=3.12"