[BUG] "Invalid condition" when editing a sigma rule that uses wildcard notation

[tallyoh]

What is the bug?
When you clone/edit an existing simga rule using the dashboard GUI - there are many rules which use a wildcard pattern notation in the conditional. (see screenshots). You cannot edit/save these rules because the dashboard GUI validation thinks this notation is invalid. Additionally, if you want to modify a rule and use wildcard notation - youcannot save the change using the dashboard gui.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Clone and edit a rule which contains wildcard notation
2. Try saving the rule and you will see the red error text preventing continuation
3. See screenshot below.

What is the expected behavior?
A clear and concise description of what you expected to happen.

What is your host/environment?

• OS: 2.10 fresh install with security analytics plugin

Do you have any screenshots?

[tallyoh]

I am not sure if I should open a seperate ticket - but I found a couple more instances where the GUI validation seems to not play well with the SIGMA rule editor screen. Rather than opening a new ticket to provide the new information I thought I would start by adding it here.

Getting a validation error when editing a clone of a rule for some author names:

[tallyoh]

Also getting the following GUI validation error on certaing rule where the tag: field within the rule starts with something other than "attack."

[tallyoh]

One really important note is that when these errors occur in the GUI - although you can go to the yaml edit view and seem to be able to continue - the rules then dont seem to take effect.

It suspect that when you click save - this triggers some background task that generates/saves the actual search query text for opensearch to monitor every x minutes for each sigma rule. For the rules that have validation errors in the GUI - it seems that no search query is generated - therefore no detections are made for that rule. The other (untouched) rules in the detector seem to work. I have seen this happen a couple of times now on different rules - but I'm still a little unclear about the exact sequence of events in the gui that cause it

if you do not try editing a sigma rule clone - then it seems to work ok. But once you edit a rule and get a gui validation error - then that individual rule seems effectively absent even though it is listed for the detector.

Thank you