From d71455c57cccd4da4aa6185755d766d2414bb1b8 Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Wed, 18 Dec 2024 16:26:51 +0900
Subject: [PATCH] fix: panic when reference rule does not have id

---
 src/detections/rule/correlation_parser.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/detections/rule/correlation_parser.rs b/src/detections/rule/correlation_parser.rs
index 44004c4e9..1aafae42a 100644
--- a/src/detections/rule/correlation_parser.rs
+++ b/src/detections/rule/correlation_parser.rs
@@ -350,7 +350,9 @@ fn parse_temporal_rules(
                         let new_id = Uuid::new_v4();
                         temporal_ref_ids.push(Yaml::String(new_id.to_string()));
                         let mut new_yaml = other_rule.yaml.clone();
-                        new_yaml["id"] = Yaml::String(new_id.to_string());
+                        if let Some(hash) = new_yaml.as_mut_hash() {
+                            hash.insert(Yaml::String("id".to_string()), Yaml::String(new_id.to_string()));
+                        }
                         let generate = temporal_yaml["correlation"]["generate"]
                             .as_bool()
                             .unwrap_or_default();