Skip to content

[SIEM] Maps adds incorrect filter to KQL bar when filtering on property existence #44711

@spong

Description

@spong

When using the Filter on property functionality within tooltips in the map, if the property doesn't exist, the KQL filter is added as

source.domain: "undefined"

instead of

(NOT source.domain:*)

maps_filter_undefined

Metadata

Metadata

Assignees

Labels

Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:SIEMbugFixes for quality problems that affect the customer experiencev7.4.0v8.0.0

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions