[Bug] Update Rule Formatter (#3668)

* Update Rule Formatter * Only apply fix to Note
elastic · May 13, 2024 · 094ef22 · 094ef22
1 parent 6150f22
commit 094ef22
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/detection_rules/rule_formatter.py b/detection_rules/rule_formatter.py
@@ -216,6 +216,11 @@ def _do_write(_data, _contents):
                 preserved_fields = ["params.message"]
                 v = [preserve_formatting_for_fields(action, preserved_fields) for action in v]
 
+            if k == 'note' and isinstance(v, str):
+                # Transform instances of \ to \\ as calling write will convert \\ to \.
+                # This will ensure that the output file has the correct number of backslashes.
+                v = v.replace("\\", "\\\\")
+
             if isinstance(v, dict):
                 bottom[k] = OrderedDict(sorted(v.items()))
             elif isinstance(v, list):