From b5dde1fcf5f54479906542a178cb87c616c7cb4f Mon Sep 17 00:00:00 2001
From: Konrad Szwarc <konrad.szwarc@elastic.co>
Date: Thu, 9 Feb 2023 18:02:53 +0100
Subject: [PATCH] [Defend Workflows] Fix: proper regexp test for dynamic
 parameters presence (#150696)

---
 .../schedule_notification_response_actions.ts                   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/schedule_notification_response_actions.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/schedule_notification_response_actions.ts
index 238f06a3d4b598..2640679a7535d9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/schedule_notification_response_actions.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_response_actions/schedule_notification_response_actions.ts
@@ -52,7 +52,7 @@ export const scheduleNotificationResponseActions = (
         ? responseAction.params.queries
         : [{ query: responseAction.params.query }];
       const containsDynamicQueries = some(temporaryQueries, (query) => {
-        return query.query ? CONTAINS_DYNAMIC_PARAMETER_REGEX.test(query.query) : false;
+        return query.query ? new RegExp(CONTAINS_DYNAMIC_PARAMETER_REGEX).test(query.query) : false;
       });
       const { savedQueryId, packId, queries, ecsMapping, ...rest } = responseAction.params;