From 17661571e5aa6ea495dd5beb7c10c887e971b19f Mon Sep 17 00:00:00 2001 From: Surya Sashank Nistala Date: Tue, 21 Nov 2023 11:18:01 -0800 Subject: [PATCH] fix rule to query conversion tests for null filter Signed-off-by: Surya Sashank Nistala --- .../securityanalytics/rules/backend/QueryBackendTests.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/test/java/org/opensearch/securityanalytics/rules/backend/QueryBackendTests.java b/src/test/java/org/opensearch/securityanalytics/rules/backend/QueryBackendTests.java index 5dc4c7a9b..1d82fe37a 100644 --- a/src/test/java/org/opensearch/securityanalytics/rules/backend/QueryBackendTests.java +++ b/src/test/java/org/opensearch/securityanalytics/rules/backend/QueryBackendTests.java @@ -288,7 +288,7 @@ public void testConvertValueNull() throws IOException, SigmaError { " sel:\n" + " fieldA1: null\n" + " condition: sel", false)); - Assert.assertEquals("mappedA: null", queries.get(0).toString()); + Assert.assertEquals("mappedA: (NOT [* TO *])", queries.get(0).toString()); } public void testConvertValueRegex() throws IOException, SigmaError { @@ -531,7 +531,7 @@ public void testConvertOrInUnallowedValueType() throws IOException, SigmaError { " - value2\n" + " - null\n" + " condition: sel", false)); - Assert.assertEquals("(mappedA: \"value1\") OR (mappedA: \"value2\") OR (mappedA: null)", queries.get(0).toString()); + Assert.assertEquals("(mappedA: \"value1\") OR (mappedA: \"value2\") OR (mappedA: (NOT [* TO *]))", queries.get(0).toString()); } public void testConvertOrInListNumbers() throws IOException, SigmaError {