[8.15] [Security Solution] Improve regexes processing KQL (#194215) (#…

…194940)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Security Solution] Improve regexes processing KQL
(#194215)](#194215)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Marshall
Main","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-04T12:22:10Z","message":"[Security
Solution] Improve regexes processing KQL (#194215)\n\n##
Summary\r\n\r\nSee linked
ticket","sha":"6d8f85e8f5e93b40696200946a4e2f696ce967fe","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:all-open"],"title":"[Security
Solution] Improve regexes processing
KQL","number":194215,"url":"https://github.com/elastic/kibana/pull/194215","mergeCommit":{"message":"[Security
Solution] Improve regexes processing KQL (#194215)\n\n##
Summary\r\n\r\nSee linked
ticket","sha":"6d8f85e8f5e93b40696200946a4e2f696ce967fe"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/194215","number":194215,"mergeCommit":{"message":"[Security
Solution] Improve regexes processing KQL (#194215)\n\n##
Summary\r\n\r\nSee linked
ticket","sha":"6d8f85e8f5e93b40696200946a4e2f696ce967fe"}}]}]
BACKPORT-->

Co-authored-by: Marshall Main <[email protected]>

x-pack/plugins/security_solution/public/common/components/ml/conditional_links/remove_kql_variables.ts

@@ -13,7 +13,7 @@ export const operators = ['and', 'or', 'not'];
 
 export const removeKqlVariablesUsingRegex = (expression: string) => {
   const myRegexp =
-    /(\s+)*(and|or|not){0,1}(\s+)*([\w\.\-\[\]]+)\s*:\s*"(\$[\w\.\-\(\)\[\]]+\$)"(\s+)*(and|or|not){0,1}(\s+)*/g;
+    /(\s*)(and|or|not){0,1}(\s*)([\w\.\-\[\]]+)\s*:\s*"(\$[\w\.\-\(\)\[\]]+\$)"(\s*)(and|or|not){0,1}(\s*)/g;
   return expression.replace(myRegexp, replacer);
 };
 

x-pack/plugins/security_solution/public/common/components/ml/conditional_links/replace_kql_commas_with_or.ts

@@ -22,7 +22,7 @@ export const replacement = (match: string, p1: string, p2: string) => {
 };
 
 export const replaceKqlCommasWithOrUsingRegex = (expression: string) => {
-  const myRegexp = /([\w\.\-\[\]]+)\s*:\s*"(([\w\.\-\(\)\[\]]+,[\w\.\-\(\)\[\]]+){1,})"/g;
+  const myRegexp = /([\w\.\-\[\]]+)\s*:\s*"(([\w\.\-\(\)\[\]]+)(,[\w\.\-\(\)\[\]]+){1,})"/g;
   return expression.replace(myRegexp, replacement);
 };