[FR] Updates to KQL Lib Parsing

lib/kql/kql/__init__.py

@@ -13,7 +13,7 @@
 from .kql2eql import KqlToEQL
 from .parser import lark_parse, KqlParser
 
-__version__ = '0.1.7'
+__version__ = '0.1.8'
 __all__ = (
     "ast",
     "from_eql",

lib/kql/kql/dsl.py

@@ -48,7 +48,8 @@ def boolean(**kwargs):
     elif boolean_type == "must_not" and len(children) == 1:
         # must_not: [{bool: {must: x}}] -> {must_not: x}
         child = children[0]
-        if list(child) == ["bool"] and list(child["bool"]) in (["filter"], ["must"]):
+        if list(child) == ["bool"] and list(child["bool"]) in (["filter"], ["must"]) and \
+            (len(child.get("bool", {}).get("filter", 1)) == 1 and len(child.get("bool", {}).get("must", 1)) == 1):
             negated, = child["bool"].values()
             dsl = {"must_not": negated}
         else:
@@ -73,7 +74,7 @@ def _walk_exists(self, _):
         return lambda field: {"exists": {"field": field}}
 
     def _walk_wildcard(self, tree):
-        return lambda field: {"query_string": {"fields": [field], "query": tree.value}}
+        return lambda field: {"wildcard": {field: { "value": tree.value}}}
 
     def _walk_value(self, tree):
         return lambda field: {"match": {field: tree.value}}

lib/kql/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detection-rules-kql"
-version = "0.1.7"
+version = "0.1.8"
 description = "Kibana Query Language parser for Elastic Detection Rules"
 license = {text = "Elastic License v2"}
 keywords = ["Elastic", "sour", "Detection Rules", "Security", "Elasticsearch", "kql"]