Security Analytics Error - 'and' operator not supported

OpenSearch
1

Getting the following error when I try do build out detection rules, detectors, etc. in the “Security Analytics” area of OpenSearch.

"Failed to retrieve rules:

[security_analytics_exception] Operator ‘and’ not supported by the backend"

I can’t find any info on this specific error when I search.
What is this referring to, and where can I find the “and” operator it’s referencing?

2

Hi @jerroot ,

Could you please share your rules configurations? What version of OpenSearch do you use?

3

We’re using OpenSearch v 2.9

Here is a sample of a detection rule I built, but I can’t go on to create a detector.

id: <ID_HERE>
logsource:
  product: azure
title: TEST_rule_TEST
description: TEST_rule_TEST
tags: []
falsepositives: []
level: medium
status: test
references: []
author: <NAME_HERE>
detection:
  condition: Severity
  Severity:
    alert_severity:
      - medium