Hello all,
Google recently launched nested if for the events part of the rules. I decided to try it out and noticed some problems
The exact same rule in doc works without any problems.
When I try to remove one of the if and make a simple if , it starts pointing out errors.
Another time I encountered an error was when I tried to perform a comparison using data tables.
The error message says that I am using an invalid type for the else field, but my else is a simple string.
Note: in the documentation, the only limitation is the maximum nesting of 20 if.
Has anyone else encountered these problems?
doc: ttps://docs.cloud.google.com/chronicle/docs/yara-l/nested-if
release note: https://docs.cloud.google.com/chronicle/docs/secops/release-notes#November_10_2025
