Allow filter-only KQL rule exports

[srkyn]

Summary

• allow query rules with empty KQL to load when Kibana filters are present
• keep empty KQL without filters invalid
• add a schema test for filter-only KQL export behavior

Validation

• python -m pytest tests/test_schemas.py::TestSchemas::test_empty_kuery_with_filters_is_valid -q
• python -m compileall -q detection_rules tests

Fixes #6167

[cla-checker-service]

💚 CLA has been signed

[srkyn]

Noticed the Add PR Guidelines Comment workflow is failing because no appropriate label was found for the PR. The linked issue #6167 has detections-as-code, but I do not have permission to add labels here. Flagging in case a maintainer needs to apply the matching label.

[github-actions]

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

• Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
• Include additional context or screenshots.
• Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the enhancement.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
• Validate that any rules affected by the enhancement are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Checks

• Verify that the enhancement works across all relevant environments (e.g., different OS versions).
• Confirm that the proper version label is applied to the PR patch, minor, major.

[eric-forte-elastic]

@srkyn thanks for the PR,

Few things to note. We would only want this for Custom Rules.

Updating your filter in rule.py to the following will fix that.

from .config import CUSTOM_RULES_DIR, load_current_package_version, parse_rules_config
...

            if not self.query.strip() and self.filters and CUSTOM_RULES_DIR:
                return None

Also, you will need to bump the patch version in the pyproject.toml

And given that you will need to update your unit test to handle this using something like:

    @unittest.mock.patch.dict(os.environ, {"CUSTOM_RULES_DIR": "/tmp"})
    @unittest.mock.patch("detection_rules.rule.CUSTOM_RULES_DIR", "/tmp")

Otherwise, this PR looks good. Let me know if you have any trouble with these updates, and I can make a PR with these and add you as co-author. Thanks!

My branch as ref: main...6167-dac-export-rules-fails-on-kql-rules-with-empty-query-filters-only

[srkyn]

Thanks for the guidance. Updated this to only bypass KQL validation for filter-only custom rules when CUSTOM_RULES_DIR is set, added a matching custom-rule test plus a guard test that prebuilt/filter-only KQL still raises, and bumped the patch version to 1.6.43.

Validation run locally:

• python -m pytest tests/test_schemas.py::TestSchemas::test_empty_kuery_with_filters_is_valid_for_custom_rules tests/test_schemas.py::TestSchemas::test_empty_kuery_with_filters_is_invalid_for_prebuilt_rules -q
• python -m compileall -q detection_rules tests