SigmaHQ / pySigma-backend-elasticsearch

pySigma Elasticsearch backend
GNU Lesser General Public License v3.0
42 stars 26 forks source link

Fix #24: fix handling of null field conditions #25

Closed Technici4n closed 1 year ago

Technici4n commented 1 year ago

Hello, here is a proposed fix for #19 and #24.

Here are the changes:

[^1]: The LuceneBackend already generates (NOT fieldA:valueA) AND (NOT fieldB:valueB), so it makes sense to enclose (NOT _exists_:field).

thomaspatzke commented 1 year ago

Thanks for your contribution!