diff --git a/detection_rules/rule.py b/detection_rules/rule.py index ba14a2f6acc..ddb371d58b4 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -708,6 +708,12 @@ def get_required_fields(self, index: str) -> List[dict]: if validator is not None: return validator.get_required_fields(index or []) + @validates_schema + def validates_index_and_data_view_id(self, data, **kwargs): + """Validate that either index or data_view_id is set, but not both.""" + if data.get('index') and data.get('data_view_id'): + raise ValidationError("Only one of index or data_view_id should be set.") + @validates_schema def validates_query_data(self, data, **kwargs): """Custom validation for query rule type and subclasses."""