Add: OpenSearch Query MustNotExists to querybuilder

Author: alex-heine

pkg/openSearch/osquery/boolQueryBuilder.go

@@ -151,7 +151,7 @@ func (q *BoolQueryBuilder) AddFilterRequest(request *filter.Request) error {
 		if handler, ok := operatorMapping[field.Operator]; ok {
 			value := field.Value
 
-			if field.Operator == filter.CompareOperatorExists {
+			if field.Operator == filter.CompareOperatorExists || field.Operator == filter.CompareOperatorMustNotExists {
 				value = "" // exists operator does not need a value, but for more consistent handling just pass a dummy value
 			}
 			if value == nil {
@@ -289,5 +289,9 @@ func defaultCompareOperators() []CompareOperator {
 			Operator: filter.CompareOperatorExists,
 			Handler:  HandleCompareOperatorExists, MustCondition: true,
 		},
+		{
+			Operator: filter.CompareOperatorMustNotExists,
+			Handler:  HandleCompareOperatorMustNotExists, MustCondition: true,
+		},
 	}
 }

pkg/openSearch/osquery/boolQueryBuilder_test.go

@@ -608,6 +608,15 @@ func TestBoolQueryBuilder_AddFilterRequest(t *testing.T) {
 		wantDocuments: []ostesting.TestType{doc0, doc1, doc2},
 	})
 
+	// MustNotExists operator
+	addTest("operator must not Exists", testCase{
+		filterRequest: singleFilter(filter.RequestField{
+			Name:     "keywordOmitEmptyField",
+			Operator: filter.CompareOperatorMustNotExists,
+		}),
+		wantDocuments: []ostesting.TestType{doc0},
+	})
+
 	// BetweenDates operator
 	addTest("operator BetweenDates (date time string)", testCase{
 		filterRequest: singleFilter(filter.RequestField{

pkg/openSearch/osquery/compareHandler.go

@@ -158,6 +158,10 @@ func HandleCompareOperatorExists(fieldName string, _ any) (esquery.Mappable, err
 	return esquery.Exists(fieldName), nil
 }
 
+func HandleCompareOperatorMustNotExists(fieldName string, _ any) (esquery.Mappable, error) {
+	return esquery.Bool().MustNot(esquery.Exists(fieldName)), nil
+}
+
 // HandleCompareOperatorBetweenDates constructs an OpenSearch range query for a given date field.
 // It accepts a field name and a field value, which must be a slice of exactly 2 elements, representing the start and end of range. Accepted slice types:
 // - []time.Time,

pkg/query/filter/type.go

@@ -75,6 +75,7 @@ CompareOperator ENUM(
 	betweenDates
 
 	exists
+	mustNotExists
 
 	isEqualToRating
 	isNotEqualToRating