tellaro-query-language 0.2.8__tar.gz → 0.2.11__tar.gz

{tellaro_query_language-0.2.8 → tellaro_query_language-0.2.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tellaro-query-language
-Version: 0.2.8
+Version: 0.2.11
 Summary: A flexible, human-friendly query language for searching and filtering structured data
 License: Proprietary
 License-File: LICENSE

{tellaro_query_language-0.2.8 → tellaro_query_language-0.2.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "tellaro-query-language"
-version = "0.2.8"
+version = "0.2.11"
 description = "A flexible, human-friendly query language for searching and filtering structured data"
 authors = ["Justin Henderson <justin@tellaro.io>"]
 license = "Proprietary"

{tellaro_query_language-0.2.8 → tellaro_query_language-0.2.11}/src/tql/core_components/opensearch_operations.py

@@ -813,10 +813,10 @@ class OpenSearchOperations:
             # scan_all mode with post-processing - process all results
             processor = QueryPostProcessor()
 
-            # Extract all documents from hits
+            # Extract all documents from initial_hits (which contains all scrolled results)
             documents = []
             hit_metadata = []
-            for hit in hits:
+            for hit in initial_hits:
                 documents.append(hit["_source"])
                 hit_metadata.append(
                     {

{tellaro_query_language-0.2.8 → tellaro_query_language-0.2.11}/src/tql/mutators/dns.py

@@ -246,20 +246,53 @@ class NSLookupMutator(BaseMutator):
 
         # Save enrichment if requested
         if save_enrichment:
-            # Always store ECS data directly, never use IP addresses as field names
+            # Determine the DNS data field (for full ECS structure)
+            # If append_field is like "destination.domain", dns_field is "destination.dns"
+            if append_field.endswith(".domain"):
+                dns_field = append_field.rsplit(".domain", 1)[0] + ".dns"
+            elif append_field == "domain":
+                dns_field = "dns"
+            else:
+                dns_field = append_field + "_dns"
+
             if len(queries) == 1 and queries[0] in resolved_results:
-                # Single query: store the ECS data directly
-                append_to_result(record, append_field, resolved_results[queries[0]])
+                # Single query: extract domain names for the domain field
+                dns_data = resolved_results[queries[0]]
+                answers = dns_data.get("answers", [])
+
+                # Store domain name(s) in the domain field (string or list of strings)
+                if len(answers) == 1:
+                    append_to_result(record, append_field, answers[0])
+                elif len(answers) > 1:
+                    append_to_result(record, append_field, answers)
+                # If no answers, don't set the domain field (leave it unset)
+
+                # Store full ECS data in the dns field
+                append_to_result(record, dns_field, dns_data)
+
             elif len(queries) > 1:
-                # Multiple queries: store as array of ECS results
+                # Multiple queries: collect all domain names and ECS results
+                all_domains = []
                 results_array = []
                 for query in queries:
                     if query in resolved_results:
-                        results_array.append(resolved_results[query])
-                append_to_result(record, append_field, results_array)
-            else:
-                # No results
-                append_to_result(record, append_field, None)
+                        dns_data = resolved_results[query]
+                        results_array.append(dns_data)
+                        answers = dns_data.get("answers", [])
+                        all_domains.extend(answers)
+
+                # Store unique domain names in the domain field
+                if all_domains:
+                    unique_domains = list(dict.fromkeys(all_domains))  # Preserve order, remove dupes
+                    if len(unique_domains) == 1:
+                        append_to_result(record, append_field, unique_domains[0])
+                    else:
+                        append_to_result(record, append_field, unique_domains)
+
+                # Store full ECS data array in the dns field
+                if results_array:
+                    append_to_result(record, dns_field, results_array)
+            # If no results, don't set any fields
 
         # For enrichment mutators, return data for comparison
         # The full enrichment data is stored via append_to_result above