Open
Description
Describe the bug
Related to #2692, it appears the original query passed validation from KQLValidator
class methods when the rule was loaded. It should have failed because one of the logic operators was missing a space which is invalid for KQL.
"Test-ServiceDaclPermission" or"Update-ExeFunctions"
Testing
We should take the rule as it was before the fix locally and set a breakpoint in KQLValidator.validate
within rule_validators.py
. This should allow us to trace the parsing and validation to determine why it did not explicitly raise an error.