[Bug] "Cobalt Strike Command and Control Beacon" SIEM rule uses Lucene query with lowercase operators

[willemdh]

"Cobalt Strike Command and Control Beacon" SIEM rule uses Lucene query with lowercase operators. The result is that it alerts on all kinds of events containing 'or' and 'and'..

Query:

((event.category: (network or network_traffic) and type: (tls or http)) or event.dataset: (network_traffic.tls or network_traffic.http)) and destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/

Screenshots
If applicable, add screenshots to help explain your problem.

• Version: 8.10.2

[w0rk3r]

Hey @willemdh, just fixed this one and a few other Lucene queries in this PR: #3196, let me know if there is anything else to fix, thanks for the contribution!