tellaro-query-language 0.2.12__tar.gz → 0.2.13__tar.gz

{tellaro_query_language-0.2.12 → tellaro_query_language-0.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tellaro-query-language
-Version: 0.2.12
+Version: 0.2.13
 Summary: A flexible, human-friendly query language for searching and filtering structured data
 License: Proprietary
 License-File: LICENSE

{tellaro_query_language-0.2.12 → tellaro_query_language-0.2.13}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "tellaro-query-language"
-version = "0.2.12"
+version = "0.2.13"
 description = "A flexible, human-friendly query language for searching and filtering structured data"
 authors = ["Justin Henderson <justin@tellaro.io>"]
 license = "Proprietary"

{tellaro_query_language-0.2.12 → tellaro_query_language-0.2.13}/src/tql/mutators/dns.py

@@ -294,28 +294,17 @@ class NSLookupMutator(BaseMutator):
                     append_to_result(record, dns_field, results_array)
             # If no results, don't set any fields
 
-        # For enrichment mutators, return data for comparison
-        # The full enrichment data is stored via append_to_result above
-        # Return value is used for field comparison (e.g., contains 'dns.google')
-
-        if len(queries) == 1 and queries[0] in resolved_results:
-            # Single query: return the first answer for comparison
-            dns_data = resolved_results[queries[0]]
-            answers = dns_data.get("answers", [])
-            return answers[0] if answers else value  # Return first answer or original value
-        elif len(queries) > 1:
-            # Multiple queries: return array of first answers
-            first_answers = []
-            for query in queries:
-                if query in resolved_results:
-                    dns_data = resolved_results[query]
-                    answers = dns_data.get("answers", [])
-                    if answers:
-                        first_answers.append(answers[0])
-            return first_answers if first_answers else value
-        else:
-            # No results: return original value
-            return value
+        # For enrichment mutators, return the original value (not the DNS answer)
+        # This ensures the original field (e.g., destination.ip) is NOT overwritten
+        # The enrichment data (domain, dns) is already stored via append_to_result above
+        #
+        # IMPORTANT: We return the original value to prevent schema violations.
+        # For example, if destination.ip is typed as 'ip' in OpenSearch,
+        # returning a hostname like '170-114-14-33.zoom.us' would cause indexing errors.
+        #
+        # If the caller needs the resolved DNS name for comparison, they should
+        # access it via the domain field (e.g., destination.domain contains 'google')
+        return value
 
     def _format_dns_ecs(  # noqa: C901
         self, query_value: str, records: List[Dict[str, Any]], query_types: List[str]