[Bug] Test Remote Rules Using Old Fields by eric-forte-elastic · Pull Request #6794 · elastic/detection-rules

eric-forte-elastic · 2026-09-15T12:41:47Z

Pull Request

Issue link(s):

Summary - What I changed

Small update to test remote rules test case to use updated fields which is now required after updating #6491

How To Test

Run test remote rules and it should now pass.

Remote CLI Test Results 🟢

Details

detection-rules on  fix_test_case_ecs [?] is  v2.2.14 via   on  eric.forte 
❯ make test-remote-cli
Installing all dependencies...
./env/detection-rules-build/bin/pip install .[dev]
Looking in indexes: https://pypi.org/simple, https://protections-bot:****@artifactory.elastic.dev/artifactory/api/pypi/pypi-endgame/simple
Processing /tmp/detection-rules
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Collecting detection-rules-kql@ git+https://github.com/elastic/detection-rules.git#subdirectory=lib/kql (from detection_rules==2.2.14)
  Cloning https://github.com/elastic/detection-rules.git to /tmp/pip-install-keitg57k/detection-rules-kql_0062f6b82f5241fab0541774ff488bc1
  Running command git clone --filter=blob:none --quiet https://github.com/elastic/detection-rules.git /tmp/pip-install-keitg57k/detection-rules-kql_0062f6b82f5241fab0541774ff488bc1
  Resolved https://github.com/elastic/detection-rules.git to commit ba8f445d3c6947db7b4f62779334bb034d9c9f70
  Running command git submodule update --init --recursive -q
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Collecting detection-rules-kibana@ git+https://github.com/elastic/detection-rules.git#subdirectory=lib/kibana (from detection_rules==2.2.14)
  Cloning https://github.com/elastic/detection-rules.git to /tmp/pip-install-keitg57k/detection-rules-kibana_a093258a34424618b175355c055832a1
  Running command git clone --filter=blob:none --quiet https://github.com/elastic/detection-rules.git /tmp/pip-install-keitg57k/detection-rules-kibana_a093258a34424618b175355c055832a1
  Resolved https://github.com/elastic/detection-rules.git to commit ba8f445d3c6947db7b4f62779334bb034d9c9f70
  Running command git submodule update --init --recursive -q
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Requirement already satisfied: Click~=8.3.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (8.3.3)
Requirement already satisfied: elasticsearch~=8.12.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (8.12.1)
Requirement already satisfied: eql==1.0.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (1.0.1)
Requirement already satisfied: jsl==0.2.4 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.2.4)
Requirement already satisfied: jsonschema>=4.21.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (4.26.0)
Requirement already satisfied: marko==2.2.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (2.2.1)
Requirement already satisfied: marshmallow-dataclass==8.7.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (8.7.1)
Requirement already satisfied: marshmallow-jsonschema~=0.16.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.16.0)
Requirement already satisfied: marshmallow-union~=0.1.15 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.1.15.post1)
Requirement already satisfied: marshmallow~=3.26.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (3.26.2)
Requirement already satisfied: pytoml==0.1.21 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.1.21)
Requirement already satisfied: PyYAML~=6.0.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (6.0.3)
Requirement already satisfied: requests~=2.33.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (2.33.1)
Requirement already satisfied: toml==0.10.2 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.10.2)
Requirement already satisfied: typing-inspect==0.9.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.9.0)
Requirement already satisfied: typing-extensions>=4.12 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (4.16.0)
Requirement already satisfied: XlsxWriter~=3.2.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (3.2.9)
Requirement already satisfied: semver==3.0.4 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (3.0.4)
Requirement already satisfied: PyGithub==2.9.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (2.9.1)
Requirement already satisfied: setuptools==83.0.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (83.0.0)
Requirement already satisfied: lark>=1.3.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from eql==1.0.1->detection_rules==2.2.14) (1.3.1)
Requirement already satisfied: typeguard<5,>=4.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from marshmallow-dataclass==8.7.1->detection_rules==2.2.14) (4.6.0)
Requirement already satisfied: pynacl>=1.4.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from PyGithub==2.9.1->detection_rules==2.2.14) (1.6.2)
Requirement already satisfied: pyjwt>=2.4.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from pyjwt[crypto]>=2.4.0->PyGithub==2.9.1->detection_rules==2.2.14) (2.14.0)
Requirement already satisfied: urllib3>=1.26.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from PyGithub==2.9.1->detection_rules==2.2.14) (2.7.0)
Requirement already satisfied: mypy-extensions>=0.3.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from typing-inspect==0.9.0->detection_rules==2.2.14) (1.1.0)
Requirement already satisfied: pep8-naming==0.15.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.15.1)
Requirement already satisfied: flake8==7.3.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (7.3.0)
Requirement already satisfied: pyflakes==3.4.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (3.4.0)
Requirement already satisfied: pytest>=8.1.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (9.1.1)
Requirement already satisfied: nodeenv==1.9.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (1.9.1)
Requirement already satisfied: pre-commit==4.6.2 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (4.6.2)
Requirement already satisfied: ruff==0.16.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (0.16.0)
Requirement already satisfied: pyright==1.1.409 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection_rules==2.2.14) (1.1.409)
Requirement already satisfied: mccabe<0.8.0,>=0.7.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from flake8==7.3.0->detection_rules==2.2.14) (0.7.0)
Requirement already satisfied: pycodestyle<2.15.0,>=2.14.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from flake8==7.3.0->detection_rules==2.2.14) (2.14.0)
Requirement already satisfied: cfgv>=2.0.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from pre-commit==4.6.2->detection_rules==2.2.14) (3.5.0)
Requirement already satisfied: identify>=1.0.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from pre-commit==4.6.2->detection_rules==2.2.14) (2.6.19)
Requirement already satisfied: virtualenv>=20.10.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from pre-commit==4.6.2->detection_rules==2.2.14) (21.7.9)
Requirement already satisfied: elastic-transport<9,>=8 in ./env/detection-rules-build/lib/python3.12/site-packages (from elasticsearch~=8.12.1->detection_rules==2.2.14) (8.19.0)
Requirement already satisfied: attrs>=22.2.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from jsonschema>=4.21.1->detection_rules==2.2.14) (26.1.0)
Requirement already satisfied: jsonschema-specifications>=2023.03.6 in ./env/detection-rules-build/lib/python3.12/site-packages (from jsonschema>=4.21.1->detection_rules==2.2.14) (2025.9.1)
Requirement already satisfied: referencing>=0.28.4 in ./env/detection-rules-build/lib/python3.12/site-packages (from jsonschema>=4.21.1->detection_rules==2.2.14) (0.37.0)
Requirement already satisfied: rpds-py>=0.25.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from jsonschema>=4.21.1->detection_rules==2.2.14) (2026.6.3)
Requirement already satisfied: packaging>=17.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from marshmallow~=3.26.1->detection_rules==2.2.14) (26.3)
Requirement already satisfied: iniconfig>=1.0.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from pytest>=8.1.1->detection_rules==2.2.14) (2.3.0)
Requirement already satisfied: pluggy<2,>=1.5 in ./env/detection-rules-build/lib/python3.12/site-packages (from pytest>=8.1.1->detection_rules==2.2.14) (1.6.0)
Requirement already satisfied: pygments>=2.7.2 in ./env/detection-rules-build/lib/python3.12/site-packages (from pytest>=8.1.1->detection_rules==2.2.14) (2.21.0)
Requirement already satisfied: charset_normalizer<4,>=2 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests~=2.33.1->detection_rules==2.2.14) (3.5.1)
Requirement already satisfied: idna<4,>=2.5 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests~=2.33.1->detection_rules==2.2.14) (3.19)
Requirement already satisfied: certifi>=2023.5.7 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests~=2.33.1->detection_rules==2.2.14) (2026.7.22)
Requirement already satisfied: cryptography>=3.4.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from pyjwt[crypto]>=2.4.0->PyGithub==2.9.1->detection_rules==2.2.14) (50.0.1)
Requirement already satisfied: cffi>=2.0.0 in ./env/detection-rules-build/lib/python3.12/site-packages (from pynacl>=1.4.0->PyGithub==2.9.1->detection_rules==2.2.14) (2.1.1)
Requirement already satisfied: distlib<1,>=0.3.7 in ./env/detection-rules-build/lib/python3.12/site-packages (from virtualenv>=20.10.0->pre-commit==4.6.2->detection_rules==2.2.14) (0.4.3)
Requirement already satisfied: filelock<4,>=3.24.2 in ./env/detection-rules-build/lib/python3.12/site-packages (from virtualenv>=20.10.0->pre-commit==4.6.2->detection_rules==2.2.14) (3.32.6)
Requirement already satisfied: platformdirs<5,>=3.9.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from virtualenv>=20.10.0->pre-commit==4.6.2->detection_rules==2.2.14) (4.11.8)
Requirement already satisfied: python-discovery>=1.6 in ./env/detection-rules-build/lib/python3.12/site-packages (from virtualenv>=20.10.0->pre-commit==4.6.2->detection_rules==2.2.14) (1.6.0)
Requirement already satisfied: pycparser in ./env/detection-rules-build/lib/python3.12/site-packages (from cffi>=2.0.0->pynacl>=1.4.0->PyGithub==2.9.1->detection_rules==2.2.14) (3.0)
Building wheels for collected packages: detection_rules
  Building wheel for detection_rules (pyproject.toml) ... done
  Created wheel for detection_rules: filename=detection_rules-2.2.14-py3-none-any.whl size=54841576 sha256=0f0f54cc9d6b3532ff70a1cbc3d720d76280c9fd509d0e97b367103e94840321
  Stored in directory: /home/forteea1/.cache/pip/wheels/27/50/e6/234daff55b5b18b929d0ba05a01ec9c13661334bf33e2727b2
Successfully built detection_rules
Installing collected packages: detection_rules
  Attempting uninstall: detection_rules
    Found existing installation: detection_rules 2.2.14
    Uninstalling detection_rules-2.2.14:
      Successfully uninstalled detection_rules-2.2.14
Successfully installed detection_rules-2.2.14

[notice] A new release of pip is available: 25.0.1 -> 26.2.1
[notice] To update, run: python3.12 -m pip install --upgrade pip
./env/detection-rules-build/bin/pip install lib/kibana
Looking in indexes: https://pypi.org/simple, https://protections-bot:****@artifactory.elastic.dev/artifactory/api/pypi/pypi-endgame/simple
Processing ./lib/kibana
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Requirement already satisfied: requests<3.0,>=2.25 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection-rules-kibana==0.4.7) (2.33.1)
Requirement already satisfied: elasticsearch~=8.12.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection-rules-kibana==0.4.7) (8.12.1)
Requirement already satisfied: elastic-transport<9,>=8 in ./env/detection-rules-build/lib/python3.12/site-packages (from elasticsearch~=8.12.1->detection-rules-kibana==0.4.7) (8.19.0)
Requirement already satisfied: charset_normalizer<4,>=2 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests<3.0,>=2.25->detection-rules-kibana==0.4.7) (3.5.1)
Requirement already satisfied: idna<4,>=2.5 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests<3.0,>=2.25->detection-rules-kibana==0.4.7) (3.19)
Requirement already satisfied: urllib3<3,>=1.26 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests<3.0,>=2.25->detection-rules-kibana==0.4.7) (2.7.0)
Requirement already satisfied: certifi>=2023.5.7 in ./env/detection-rules-build/lib/python3.12/site-packages (from requests<3.0,>=2.25->detection-rules-kibana==0.4.7) (2026.7.22)
Building wheels for collected packages: detection-rules-kibana
  Building wheel for detection-rules-kibana (pyproject.toml) ... done
  Created wheel for detection-rules-kibana: filename=detection_rules_kibana-0.4.7-py3-none-any.whl size=9558 sha256=b7a20c6cf1484184b9d813282a2c99e932d830cb10cc610a0839fc351e0630b6
  Stored in directory: /tmp/pip-ephem-wheel-cache-1yw0_r26/wheels/aa/46/42/a74ba0bf32d78f2e21201bfdbc68f485ba3df00e17501e1f6c
Successfully built detection-rules-kibana
Installing collected packages: detection-rules-kibana
  Attempting uninstall: detection-rules-kibana
    Found existing installation: detection-rules-kibana 0.4.7
    Uninstalling detection-rules-kibana-0.4.7:
      Successfully uninstalled detection-rules-kibana-0.4.7
Successfully installed detection-rules-kibana-0.4.7

[notice] A new release of pip is available: 25.0.1 -> 26.2.1
[notice] To update, run: python3.12 -m pip install --upgrade pip
./env/detection-rules-build/bin/pip install lib/kql
Looking in indexes: https://pypi.org/simple, https://protections-bot:****@artifactory.elastic.dev/artifactory/api/pypi/pypi-endgame/simple
Processing ./lib/kql
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Requirement already satisfied: eql==1.0.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection-rules-kql==0.1.17) (1.0.1)
Requirement already satisfied: lark>=1.3.1 in ./env/detection-rules-build/lib/python3.12/site-packages (from detection-rules-kql==0.1.17) (1.3.1)
Building wheels for collected packages: detection-rules-kql
  Building wheel for detection-rules-kql (pyproject.toml) ... done
  Created wheel for detection-rules-kql: filename=detection_rules_kql-0.1.17-py3-none-any.whl size=22387 sha256=20a425b38195c816e807542a480363be90ae27ff71f1158add975365ecd87c0c
  Stored in directory: /tmp/pip-ephem-wheel-cache-6mn6i3_3/wheels/19/08/2a/f976d7948bc0df4649029b7e3c10215f3260767496d3cf6cfe
Successfully built detection-rules-kql
Installing collected packages: detection-rules-kql
  Attempting uninstall: detection-rules-kql
    Found existing installation: detection-rules-kql 0.1.17
    Uninstalling detection-rules-kql-0.1.17:
      Successfully uninstalled detection-rules-kql-0.1.17
Successfully installed detection-rules-kql-0.1.17

[notice] A new release of pip is available: 25.0.1 -> 26.2.1
[notice] To update, run: python3.12 -m pip install --upgrade pip
Executing test_remote_cli script...
Running detection-rules remote CLI tests...
Performing a quick rule alerts search...
Requires .detection-rules-cfg.json credentials file set.
Loaded config file: /tmp/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/urllib3/connectionpool.py:1110: InsecureRequestWarning: Unverified HTTPS request is being made to host '1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
No alerts detected
Setting Up Custom Directory...
Loaded config file: /tmp/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Created directory: tmp-custom/actions
Created directory: tmp-custom/action_connectors
Created directory: tmp-custom/exceptions
Created directory: tmp-custom/rules
Created directory: tmp-custom/rules_building_block
Created directory: tmp-custom/etc
Created file with default content: tmp-custom/etc/deprecated_rules.json
Created file with default content: tmp-custom/etc/version.lock.json
Created file with default content: tmp-custom/etc/packages.yaml
Created file with default content: tmp-custom/etc/stack-schema-map.yaml
Created file with default content: tmp-custom/etc/test_config.yaml
Created file with default content: tmp-custom/_config.yaml

# For details on how to configure the _config.yaml file,
# consult: /tmp/detection-rules/detection_rules/etc/_config.yaml
# or the docs: /tmp/detection-rules/docs-dev/custom-rules-management.md
Performing a rule conversion from ndjson to toml files...
Loaded config file: /tmp/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[+] Building rule for tmp-custom/rules/test_kql_rule.toml
[+] Building rule for tmp-custom/rules/test_kql_with_alert_supprestion_and_investigation_fileds.toml
[+] Building rule for tmp-custom/rules/test_kql_with_alert_suppression.toml
[+] Building rule for tmp-custom/rules/test_eql_rule.toml
[+] Building rule for tmp-custom/rules/test_esql_rule_with_shared_rule_exception.toml
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/urllib3/connectionpool.py:1110: InsecureRequestWarning: Unverified HTTPS request is being made to host '1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:443' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/detection_rules/index_mappings.py:404: ElasticsearchWarning: No limit defined, adding default limit of [1000]
  response = elastic_client.esql.query(query=query)
[+] Building rule for tmp-custom/rules/test_new_terms_rule_with_shared_rule_exception.toml
[+] Building rule for tmp-custom/rules/test_indicator_match_rule_with_email_actions.toml
[+] Building rule for tmp-custom/rules/test_threshold_with_rule_exception.toml
[+] Building rule for tmp-custom/rules/test_machine_learning_rule_with_index_action_connector.toml
[+] Building exception(s) for /tmp/detection-rules/tmp-custom/exceptions/1c8a1378-8f0d-4565-9ae0-abeeaf3981ca_exceptions.toml
[+] Building exception(s) for /tmp/detection-rules/tmp-custom/exceptions/0a4124f8-2074-450b-8689-d7dee319c666_exceptions.toml
[+] Building action connector(s) for /tmp/detection-rules/tmp-custom/action_connectors/e1b418e7-78df-4042-bfb0-1cc5fb6f7a4e_actions.toml
[+] Building action connector(s) for /tmp/detection-rules/tmp-custom/action_connectors/1b8d347f-2542-4390-85de-2653518311e2_actions.toml
15 results exported
9 rules converted
4 exceptions exported
2 actions connectors exported
Performing a rule import to kibana...
Loaded config file: /tmp/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/urllib3/connectionpool.py:1110: InsecureRequestWarning: Unverified HTTPS request is being made to host '1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:443' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/detection_rules/index_mappings.py:404: ElasticsearchWarning: No limit defined, adding default limit of [1000]
  response = elastic_client.esql.query(query=query)
9 rule(s) successfully imported
 - 2cc8f325-e1b1-4201-8b8d-88a51c94992b
 - 7e0f6dae-5847-465f-89e9-a6de0e9ef918
 - 4c589d81-2622-4036-8cc7-372ea8f0e038
 - bcbd5906-fc38-4cbe-8b54-c2dba5d4b127
 - 2c6c5352-11cb-40a5-9294-e61ef5f1954f
 - 742feb36-ac4c-45e0-b8a5-3b3cfa66b6d2
 - 8a3296e2-4a74-4d51-b819-8d4e58377bf7
 - 2390c9dd-ad90-4af6-97a4-1d607ba0f092
 - d46a29ca-9b5b-4cbd-b11f-35c6b59f207b
2 exception list(s) successfully imported
 - 0a4124f8-2074-450b-8689-d7dee319c666
 - 1c8a1378-8f0d-4565-9ae0-abeeaf3981ca
2 action connector(s) successfully imported
 - e1b418e7-78df-4042-bfb0-1cc5fb6f7a4e
 - 1b8d347f-2542-4390-85de-2653518311e2
Performing a rule export...
Loaded config file: /tmp/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/urllib3/connectionpool.py:1110: InsecureRequestWarning: Unverified HTTPS request is being made to host '1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:443' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:443' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/detection_rules/index_mappings.py:404: ElasticsearchWarning: No limit defined, adding default limit of [1000]
  response = elastic_client.esql.query(query=query)
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:443' using TLS with verify_certs=False is insecure
  _transport = transport_class(
/tmp/detection-rules/detection_rules/index_mappings.py:404: ElasticsearchWarning: No limit defined, adding default limit of [1000]
  response = elastic_client.esql.query(query=query)
17 results exported
11 rules converted
2 exceptions exported
2 action connectors exported
11 rules saved to tmp-custom
2 exception lists saved to /tmp/detection-rules/tmp-custom/exceptions
2 action connectors saved to /tmp/detection-rules/tmp-custom/action_connectors
Testing ESQL Rules...
============================================================================================================ test session starts ============================================================================================================
platform linux -- Python 3.12.13, pytest-9.1.1, pluggy-1.6.0
rootdir: /tmp/detection-rules
configfile: pyproject.toml
plugins: typeguard-4.6.0
collected 18 items                                                                                                                                                                                                                          

tests/test_rules_remote.py ..................                                                                                                                                                                                         [100%]

============================================================================================================= warnings summary ==============================================================================================================
tests/test_rules_remote.py: 20 warnings
  /tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:9243' using TLS with verify_certs=False is insecure
    _transport = transport_class(

tests/test_rules_remote.py: 16 warnings
  /tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/urllib3/connectionpool.py:1110: InsecureRequestWarning: Unverified HTTPS request is being made to host '1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
    warnings.warn(

tests/test_rules_remote.py: 20 warnings
  /tmp/detection-rules/env/detection-rules-build/lib/python3.12/site-packages/elasticsearch/_sync/client/__init__.py:399: SecurityWarning: Connecting to 'https://1a8f668b556245818b2097f90dfaddb1.us-east-1.aws.found.io:443' using TLS with verify_certs=False is insecure
    _transport = transport_class(

tests/test_rules_remote.py: 14 warnings
  /tmp/detection-rules/detection_rules/index_mappings.py:404: ElasticsearchWarning: No limit defined, adding default limit of [1000]
    response = elastic_client.esql.query(query=query)

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
===================================================================================================== 18 passed, 70 warnings in 44.75s ======================================================================================================
Removing generated files...
Detection-rules Remote CLI tests completed!

Remote Rules Test

Checklist

Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
Added the meta:rapid-merge label if planning to merge within 24 hours
Secret and sensitive material has been managed correctly
Automated testing was updated or added to match the most common scenarios
Documentation and comments were added for features that require explanation

Contributor checklist

Have you signed the contributor license agreement?
Have you followed the contributor guidelines?

Copilot

🟢 Approval recommended

Reviewed changes address the outdated test fields and all assessments found no blocking issues.

Pull request overview

Updates remote ES|QL tests to use the current data_stream.dataset field and bumps the project version.

Changes:

Updated two remote test queries.
Bumped version from 2.2.13 to 2.2.14.

File summaries

File	Summary
`tests/test_rules_remote.py`	Updated ES\|QL queries to use current dataset mappings.
`pyproject.toml`	Bumped the package version.

Review details

Files reviewed: 2/2 changed files
Comments generated: 0
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Bring in #6794 remote fixture updates and other mainline changes.

eric-forte-elastic added 2 commits September 15, 2026 08:39

[Bug] Test Remote Rules Using Old Fields

17af758

patch bump

e7ae1f5

eric-forte-elastic self-assigned this Sep 15, 2026

eric-forte-elastic added bug Something isn't working python Internal python for the repository patch labels Sep 15, 2026

shashank-elastic approved these changes Sep 15, 2026

View reviewed changes

Aegrah approved these changes Sep 15, 2026

View reviewed changes

Mikaayenson approved these changes Sep 15, 2026

View reviewed changes

eric-forte-elastic marked this pull request as ready for review September 15, 2026 13:11

Copilot AI lite review requested due to automatic review settings September 15, 2026 13:11

github-actions Bot added the backport: auto label Sep 15, 2026

Copilot started reviewing on behalf of eric-forte-elastic September 15, 2026 13:12 View session

eric-forte-elastic added this pull request to the merge queue Sep 15, 2026

bryans3c approved these changes Sep 15, 2026

View reviewed changes

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Merged via the queue into main with commit 05d8ac6 Sep 15, 2026
63 checks passed

eric-forte-elastic deleted the fix_test_case_ecs branch September 15, 2026 13:26

Mikaayenson added a commit that referenced this pull request Sep 16, 2026

Merge origin/main into feature/python-esql-offline.

54df6db

Bring in #6794 remote fixture updates and other mainline changes.

Navigation Menu

[Bug] Test Remote Rules Using Old Fields - #6794

[Bug] Test Remote Rules Using Old Fields#6794
eric-forte-elastic merged 2 commits into
mainfrom
fix_test_case_ecs

eric-forte-elastic commented Sep 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

eric-forte-elastic commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Summary - What I changed

How To Test

Checklist

Contributor checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

eric-forte-elastic commented Sep 15, 2026 •

edited

Loading