fix null query filter conversion from sigma to query string query

Signed-off-by: Surya Sashank Nistala <[email protected]>
opensearch-project · Nov 21, 2023 · a2731de · a2731de
1 parent 0db4dd3
commit a2731de
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java b/src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java
@@ -131,7 +131,7 @@ public OSQueryBackend(Map<String, String> fieldMappings, boolean collectErrors,
         this.reEscapeChar = "\\";
         this.reExpression = "%s: /%s/";
         this.cidrExpression = "%s: \"%s\"";
-        this.fieldNullExpression = "%s: null";
+        this.fieldNullExpression = "%s: (NOT [* TO *])";
         this.unboundValueStrExpression = "%s: \"%s\"";
         this.unboundValueNumExpression = "%s: %s";
         this.unboundWildcardExpression = "%s: %s";