[DaC] [Bug] Rule Formatter Line Wrapping Breaks Query String Filters

[eric-forte-elastic]

Pull Request

Issue link(s):

Resolves #6045
Resolves #6071
Closes #6074

Summary - What I changed

This PR updates the logic for handling long KQL Literals that can be incorrectly newline split when writing from ndjson -> TOML through our rule formatter that wraps the text output at 120 characters.

Left is new desired output, and the right is the old output.

Instead of turning this into a multi-line. We now are preserving the format of any value underneath query from the Kibana Filter dataclass.

How To Test

Import and export the pre-built rule rules/windows/defense_evasion_posh_assembly_load.toml and see if the following query path is wrapped or not.

[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\Monitoring Host Temporary Files*\\AvailabilityGroupMonitoring.ps1"

To help with this you can use the following ndjson

test_string_conversion.ndjson.txt

❯ python -m detection_rules import-rules-to-repo -ac -e test_string_conversion.ndjson --required-only
Loaded config file: /home/forteea1/tmp/tmp/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[+] Building rule for /home/forteea1/tmp/tmp/detection-rules/custom_rules/rules/suspicious_net_reflection_via_powershell.toml
1 results exported
1 rules converted
0 exceptions exported
0 actions connectors exported

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Bug - Guidelines

These guidelines serve as a reminder set of considerations when addressing a bug in the code.

Documentation and Context

• Provide detailed documentation (description, screenshots, reproducing the bug, etc.) of the bug if not already documented in an issue.
• Include additional context or details about the problem.
• Ensure the fix includes necessary updates to the release documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the bug fix or edge cases.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and detecting the bug fix (e.g., test logs, screenshots).
• Validate that any rules affected by the bug are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Checks

• Verify that the bug fix works across all relevant environments (e.g., different OS versions).
• Confirm that the proper version label is applied to the PR patch, minor, major.

[terrancedejesus]

Deep dived with @eric-forte-elastic on this. Approving!

[Mikaayenson]

small nit suggestion. otherwise lgtm. might need to lint