fix(deceptive-bytes): only run the ransomware history search when its placeholders exist

The ransomware rule searches history on {{.log.process}} and {{.log.source_ip}}, but its condition did not require those fields. A missing placeholder makes the search fail, and five failures switch the rule off with a Circuit Breaker alert. Require both fields, as the data theft, advanced threat tactic and zero-day rules already require theirs.

The history-guard test now covers the four rules and checks that a rule does not match without any one of the fields it needs; it fails on the unguarded ransomware rule. go-sdk v1.1.36 replay: the unguarded rule matched two lines that each lacked one field, with unresolved placeholders; the guarded rule matches only the line with both (65 of 65 checks). Full plugins/alerts suite: 48 pass, 11 skip, 0 fail; replay.py on EventProcessor 8a3ade7 still passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: kryonsx

filters/audits/deceptive-bytes.md

@@ -69,8 +69,15 @@ Three rules run a history search on `{{.origin.ip}}` (and `{{.log.tacticName}}`
 placeholder makes the search fail, and five failures switch a rule off with a
 Circuit Breaker alert, so the data theft, advanced threat tactic and zero-day
 conditions now also require those fields, as the other seven `origin.ip` rules of
-this source already do. `ransomware_behavior_patterns` still searches on
-`{{.log.process}}` and `{{.log.source_ip}}` without requiring them; that is unchanged.
+this source already do. For the same reason `ransomware_behavior_patterns`, which
+searches on `{{.log.process}}` and `{{.log.source_ip}}`, now requires both fields. The
+history-guard test checks each of the four rules: no match without the fields it needs or
+without any one of them, a match with them, and every placeholder resolved. Without the
+ransomware guard it fails; the go-sdk v1.1.36 replay over the playground events plus two
+copies of the ransomware line that each lack one of those fields then matched both copies
+with unresolved placeholders. With the guard the same replay passes 65 of 65 checks: each
+rule matches only its intended case, and the ransomware rule only the line that carries
+both fields.
 
 The committed fabricated lines carry all 18 keys. On EventProcessor `8a3ade7` the KV
 plugin stored every one with its underscore (for example `log.event_type`,

plugins/alerts/deceptive_bytes_history_guard_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"encoding/json"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -11,17 +12,55 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 )
 
+// deceptiveBytesEvent builds an event from a log object plus dotted fields.
+func deceptiveBytesEvent(t *testing.T, logFields map[string]any, extra map[string]string) string {
+	t.Helper()
+	logCopy := map[string]any{}
+	for k, v := range logFields {
+		logCopy[k] = v
+	}
+	event := map[string]any{"dataType": "deceptive-bytes", "log": logCopy}
+	for path, value := range extra {
+		parts := strings.Split(path, ".")
+		node := event
+		for _, part := range parts[:len(parts)-1] {
+			next, ok := node[part].(map[string]any)
+			if !ok {
+				next = map[string]any{}
+				node[part] = next
+			}
+			node = next
+		}
+		node[parts[len(parts)-1]] = value
+	}
+	b, err := json.Marshal(event)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
 // A history search whose placeholder is missing returns an error, and five errors switch the
 // rule off with a Circuit Breaker alert. Each rule must only match when its placeholders exist.
 func TestDeceptiveBytesHistoryPlaceholdersGuarded(t *testing.T) {
 	cache := plugins.NewCELCache("deceptive-bytes-history-guard")
 	cases := []struct {
-		rule  string
-		event string
+		rule   string
+		log    map[string]any    // matches the condition apart from the placeholder fields
+		needed map[string]string // the fields the history placeholders read
 	}{
-		{"data_theft_attempt_indicators", `{"event_type":"decoy_accessed","action":"file_copy","decoy_sensitivity":"high","decoy_file":"f"}`},
-		{"advanced_threat_tactic_identification", `{"eventType":"advanced_threat_detected","threatLevel":"critical","tacticName":"execution","deceptionTriggered":"true","behaviorScore":95}`},
-		{"zero_day_behavior_patterns", `{"eventType":"zero_day_suspect","threatSignature":"unknown","deceptionEnvironment":"true","memoryAnomalyScore":95,"knownMalwareFamily":"","exploitTechnique":"t","processName":"p.exe"}`},
+		{"data_theft_attempt_indicators",
+			map[string]any{"event_type": "decoy_accessed", "action": "file_copy", "decoy_sensitivity": "high", "decoy_file": "f"},
+			map[string]string{"origin.ip": "192.0.2.10"}},
+		{"advanced_threat_tactic_identification",
+			map[string]any{"eventType": "advanced_threat_detected", "threatLevel": "critical", "tacticName": "execution", "deceptionTriggered": "true", "behaviorScore": 95},
+			map[string]string{"origin.ip": "192.0.2.10"}},
+		{"zero_day_behavior_patterns",
+			map[string]any{"eventType": "zero_day_suspect", "threatSignature": "unknown", "deceptionEnvironment": "true", "memoryAnomalyScore": 95, "knownMalwareFamily": "", "exploitTechnique": "t", "processName": "p.exe"},
+			map[string]string{"origin.ip": "192.0.2.10"}},
+		{"ransomware_behavior_patterns",
+			map[string]any{"event_type": "ransomware_behavior", "behavior_pattern": "mass_encryption"},
+			map[string]string{"log.process": "example.exe", "log.source_ip": "192.0.2.10"}},
 	}
 	for _, tc := range cases {
 		b, err := utils.ReadPbYaml(filepath.Join("../..", "rules/antivirus/deceptive-bytes", tc.rule+".yml"))
@@ -33,15 +72,26 @@ func TestDeceptiveBytesHistoryPlaceholdersGuarded(t *testing.T) {
 			t.Fatal(err)
 		}
 		rule.Normalize()
-		without := `{"dataType":"deceptive-bytes","log":` + tc.event + `}`
-		with := `{"dataType":"deceptive-bytes","origin":{"ip":"192.0.2.10"},"log":` + tc.event + `}`
 		t.Run(tc.rule, func(t *testing.T) {
-			if got, err := cache.Eval(rule.Where, without); err != nil || got {
-				t.Errorf("matched without origin.ip: %v (%v)", got, err)
+			// Without the placeholder fields, and without any one of them, the rule must not match.
+			if got, err := cache.Eval(rule.Where, deceptiveBytesEvent(t, tc.log, nil)); err != nil || got {
+				t.Errorf("matched without %v: %v (%v)", tc.needed, got, err)
+			}
+			for missing := range tc.needed {
+				partial := map[string]string{}
+				for path, value := range tc.needed {
+					if path != missing {
+						partial[path] = value
+					}
+				}
+				if got, err := cache.Eval(rule.Where, deceptiveBytesEvent(t, tc.log, partial)); err != nil || got {
+					t.Errorf("matched without %s: %v (%v)", missing, got, err)
+				}
 			}
+			with := deceptiveBytesEvent(t, tc.log, tc.needed)
 			got, err := cache.Eval(rule.Where, with)
 			if err != nil || !got {
-				t.Fatalf("did not match with origin.ip: %v (%v)", got, err)
+				t.Fatalf("did not match with %v: %v (%v)", tc.needed, got, err)
 			}
 			for _, block := range rule.Correlation {
 				for _, expr := range block.With {

rules/antivirus/deceptive-bytes/ransomware_behavior_patterns.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - deceptive-bytes
@@ -29,7 +29,9 @@ description: |
   9. Review backup integrity and availability before any restoration attempts
 where: |
   equals("log.event_type", "ransomware_behavior") &&
-  oneOf("log.behavior_pattern", ["mass_encryption", "file_enumeration", "ransom_note_drop"])
+  oneOf("log.behavior_pattern", ["mass_encryption", "file_enumeration", "ransom_note_drop"]) &&
+  exists("log.process") &&
+  exists("log.source_ip")
 afterEvents:
   - indexPattern: v11-log-deceptive-bytes-*
     with: