Significant EQL changes in 7.10 #62652
Description
This ticket serves as a central place for significant changes in EQL to better broadcast them to a larger group.
To keep things simple, please keep the discussions on each individual ticket.
Proposed grammar changes
Case sensitivity - High impact on semantics / rules
Concluded
- Remove any overloading of
==including that of wildcardsfoo == "*.exe". May end up influencing the grammar.
Issue: EQL: Remove pattern== "wild*card"#62651 - Replace
`with'(available - see above) for quoting identifiers
Issues: EQL: Replace ` (back-tick) with ' (single quote) #62663 PR: EQL: Replace [`] with ['] for identifiers #62638 - Replace
?"and?'for raw string literal"""
Issue: EQL: Replace ?" and ?' with """ #62645 PR: EQL: Replace ?"..." with """...""" for unescaped strings #62539 - Remove case-sensitivity parameter and make EQL case in-sensitive by default - impacted by EQL: Remove pattern
== "wild*card"#62651
Issue: EQL: Revisit case insensitivity #61883 and EQL: Remove case_sensitive option #62255 - Remove
'for string literal declaration and keep only"
Issue: EQL: changes to strings and regular expressions #61659 PR: EQL: Forbid usage of ['] for string literals #62458 - Disallow 1 == 1 == 1
Issue: EQL: ambiguous syntax for chained predicates #61654, PR:EQL: Disallow chained comparisons #62567 - Deprecate usage of
=for equality checks in favor of==.
Issue: EQL: Remove (was Deprecate)=in favor of==for equality checks #62650 PR: EQL: Remove support for=for comparisons #62756
(Edit: @rw-access changed the wording to "Proposed grammar changes" to be more clear)