How should a composite YARA-L rule access outcome variables from a child rule now that detection.detection.outcomes is deprecated?

Hi ​@Mufa_shah,

A very interesting finding, especially since this field is being referenced in fairly recent community posts, i,.e: 

I’d be inclined to say this is probably not a deprecated field, and works fine in our environment.

Kind Regards,

Ayman
 

Take a look at Google SecOps Detection Engine API Reference :

detection.outcomes - Deprecated. Use variables instead. A list of outcomes that represent the results of this security finding. Only populated when the security result appears in a detection.

The deprecation applies to detection.detection.outcomes. Composite rules should now read the child rule’s output through the typed variables map.

For a scalar string outcome:

$dest_domain =

  $exec_alert.detection.detection.variables["dest_domain"].string_val

$host =

  $exec_alert.detection.detection.variables["host"].string_val

The type suffix must match the value produced by the child rule. For example, a string sequence can be accessed with:

$first_domain =

  $exec_alert.detection.detection.variables["dest_domain"]

    .string_seq.string_vals[0]

outcomes remains available for backward compatibility and returns string representations, but variables is the current replacement and preserves the original value type. �

Google Cloud Documentation +1

Therefore, the direct replacement for:

$exec_alert.detection.detection.outcomes["dest_domain"]

is:

$exec_alert.detection.detection.variables["dest_domain"].string_val

That directly resolves the question instead of merely confirming that the old field is deprecated.