paulinashakirova
diff --git a/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/index.ts‎
Lines changed: 1 addition & 0 deletions b/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/index.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/moon.yml‎
Lines changed: 1 addition & 0 deletions b/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/moon.yml‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/src/malformed_matches_value_callout/index.tsx‎
Lines changed: 56 additions & 0 deletions b/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/src/malformed_matches_value_callout/index.tsx‎
Lines changed: 56 additions & 0 deletions
diff --git a/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/tsconfig.json‎
Lines changed: 1 addition & 0 deletions b/‎x-pack/solutions/security/packages/kbn-securitysolution-exception-list-components/tsconfig.json‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎x-pack/solutions/security/packages/kbn-securitysolution-list-utils/src/helpers/index.test.ts‎
Lines changed: 183 additions & 0 deletions b/‎x-pack/solutions/security/packages/kbn-securitysolution-list-utils/src/helpers/index.test.ts‎
Lines changed: 183 additions & 0 deletions
diff --git a/‎x-pack/solutions/security/packages/kbn-securitysolution-list-utils/src/helpers/index.ts‎
Lines changed: 45 additions & 28 deletions b/‎x-pack/solutions/security/packages/kbn-securitysolution-list-utils/src/helpers/index.ts‎
Lines changed: 45 additions & 28 deletions
@@ -17,4 +17,5 @@ export * from './src/header_menu';
 export * from './src/generate_linked_rules_menu_item';
 export * from './src/unnecessary_escaping_callout';
 export * from './src/wildcard_with_wrong_operator_callout';
+export * from './src/malformed_matches_value_callout';
 export * from './src/partial_code_signature_callout';
@@ -22,6 +22,7 @@ dependsOn:
   - '@kbn/i18n'
   - '@kbn/i18n-react'
   - '@kbn/kibana-react-plugin'
+  - '@kbn/securitysolution-list-utils'
 tags:
   - shared-browser
   - package
 
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { i18n } from '@kbn/i18n';
+import { EuiCallOut } from '@elastic/eui';
+import { isOperator, matchesOperator } from '@kbn/securitysolution-list-utils';
+
+export const MalformedMatchesValueCallout = () => {
+  return (
+    <EuiCallOut
+      title={i18n.translate('exceptionList-components.malformedMatchesValueCallout.title', {
+        defaultMessage: 'Please review your entries',
+      })}
+      iconType="warning"
+      color="warning"
+      size="s"
+      data-test-subj="malformedMatchesValueCallout"
+    >
+      <p>
+        <FormattedMessage
+          id="exceptionList-components.malformedMatchesValueCallout.body"
+          defaultMessage="An entry uses {matches} with a value containing escape sequences (e.g. {escapedStar}, {escapedQuestion}). These will {literalCharacters}, not wildcard patterns (for example {escapedStar2} matches a literal asterisk). If you intended an exact match, {changeOperator} to {is}."
+          values={{
+            matches: <strong>{matchesOperator.message}</strong>,
+            is: <strong>{isOperator.message}</strong>,
+            escapedStar: <code>{'\\*'}</code>,
+            escapedStar2: <code>{'\\*'}</code>,
+            escapedQuestion: <code>{'\\?'}</code>,
+            literalCharacters: (
+              <strong>
+                {i18n.translate(
+                  'exceptionList-components.malformedMatchesValueCallout.literalCharacters',
+                  { defaultMessage: 'match literal characters' }
+                )}
+              </strong>
+            ),
+            changeOperator: (
+              <strong>
+                {i18n.translate(
+                  'exceptionList-components.malformedMatchesValueCallout.changeOperator',
+                  { defaultMessage: 'change the operator' }
+                )}
+              </strong>
+            ),
+          }}
+        />
+      </p>
+    </EuiCallOut>
+  );
+};
@@ -20,6 +20,7 @@
     "@kbn/i18n",
     "@kbn/i18n-react",
     "@kbn/kibana-react-plugin",
+    "@kbn/securitysolution-list-utils",
   ],
   "exclude": [
     "target/**/*",
 
@@ -11,6 +11,7 @@ import {
   hasWrongOperatorWithWildcard,
   hasEscaping,
   hasPartialCodeSignatureEntry,
+  getMalformedMatchesFields,
   getOperatorOptions,
   hasEntryEscaping,
 } from '.';
@@ -643,6 +644,188 @@ describe('Helpers', () => {
     });
   });
 
+  describe('getMalformedMatchesFields', () => {
+    test('it returns the field name for a wildcard entry with an escaped asterisk', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'wildcard',
+                value: 'app\\*.exe',
+                field: 'process.name',
+                operator: 'included',
+              },
+            ],
+          },
+        ])
+      ).toEqual(['process.name']);
+    });
+
+    test('it returns the field name for a wildcard entry with an escaped question mark', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              { type: 'wildcard', value: 'file\\?.txt', field: 'file.name', operator: 'included' },
+            ],
+          },
+        ])
+      ).toEqual(['file.name']);
+    });
+
+    test('it returns multiple field names when multiple entries have escaped wildcards', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'wildcard',
+                value: 'app\\*.exe',
+                field: 'process.name',
+                operator: 'included',
+              },
+              {
+                type: 'wildcard',
+                value: 'file\\?.txt',
+                field: 'file.name',
+                operator: 'included',
+              },
+            ],
+          },
+        ])
+      ).toEqual(['process.name', 'file.name']);
+    });
+
+    test('it collects fields across OR conditions (multiple items)', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'wildcard',
+                value: 'app\\*.exe',
+                field: 'process.name',
+                operator: 'included',
+              },
+            ],
+          },
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'wildcard',
+                value: 'file\\?.txt',
+                field: 'file.name',
+                operator: 'included',
+              },
+            ],
+          },
+        ])
+      ).toEqual(['process.name', 'file.name']);
+    });
+
+    test('it returns empty array when no entries have escaped wildcards', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'wildcard',
+                value: 'chrome*.exe',
+                field: 'process.name',
+                operator: 'included',
+              },
+            ],
+          },
+        ])
+      ).toEqual([]);
+    });
+
+    test('it returns empty array for an empty entries list', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [],
+          },
+        ])
+      ).toEqual([]);
+    });
+
+    test('it excludes entries with an empty field name', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [{ type: 'wildcard', value: 'app\\*.exe', field: '', operator: 'included' }],
+          },
+        ])
+      ).toEqual([]);
+    });
+
+    test('it does not include match entries even if value contains escape sequences', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'match',
+                value: 'app\\*.exe',
+                field: 'process.name',
+                operator: 'included',
+              },
+            ],
+          },
+        ])
+      ).toEqual([]);
+    });
+
+    test('it does not flag a double-backslash before a wildcard (Windows path separator)', () => {
+      expect(
+        getMalformedMatchesFields([
+          {
+            description: '',
+            name: '',
+            type: 'simple',
+            entries: [
+              {
+                type: 'wildcard',
+                value: 'C:\\\\Windows\\\\*.dll',
+                field: 'file.path',
+                operator: 'included',
+              },
+            ],
+          },
+        ])
+      ).toEqual([]);
+    });
+  });
+
   describe('getOperatorOptions', () => {
     const getItem = (overrides?: {
       nested?: FormattedBuilderEntry['nested'];
 
@@ -1027,49 +1027,43 @@ export const getMappingConflictsInfo = (field: DataViewField): FieldConflictsInf
   return conflicts;
 };
 
+/** Flattens exception items into a single list of leaf entries, expanding nested entry children. */
+const flattenExceptionEntries = (
+  items: Array<Pick<ExceptionsBuilderReturnExceptionItem, 'entries'>>
+): BuilderEntry[] =>
+  items
+    .flatMap((item) => item.entries)
+    .flatMap((item) => (item.type === 'nested' ? item.entries : item));
+
+/** Narrows a BuilderEntry to one that uses the wildcard operator with a string value. */
+const isWildcardStringEntry = (
+  builderEntry: BuilderEntry
+): builderEntry is BuilderEntry & { type: 'wildcard'; value: string } =>
+  builderEntry.type === 'wildcard' &&
+  'value' in builderEntry &&
+  typeof builderEntry.value === 'string';
+
 /**
  * Given an exceptions list, determine if any entries have an "IS" operator with a wildcard value
  */
 export const hasWrongOperatorWithWildcard = (
   items: ExceptionsBuilderReturnExceptionItem[]
-): boolean => {
-  // flattens array of multiple entries added with OR
-  const multipleEntries = items.flatMap((item) => item.entries);
-  // flattens nested entries
-  const allEntries = multipleEntries.flatMap((item) => {
-    if (item.type === 'nested') {
-      return item.entries;
-    }
-    return item;
-  });
-
-  // eslint-disable-next-line array-callback-return
-  return allEntries.some((e) => {
-    if (e.type !== 'list' && 'value' in e) {
+): boolean =>
+  flattenExceptionEntries(items).some((e) => {
+    if (e.type !== 'list' && 'value' in e && e.value != null) {
       return validateHasWildcardWithWrongOperator({
         operator: e.type,
         value: e.value,
       });
     }
+    return false;
   });
-};
 
 export const hasEscaping = (
   items: Array<Pick<ExceptionsBuilderReturnExceptionItem, 'entries'>>,
   osTypes: ExceptionsBuilderReturnExceptionItem['os_types'] = ['linux']
-): boolean => {
-  // flattens array of multiple entries added with OR
-  const multipleEntries = items.flatMap((item) => item.entries);
-  // flattens nested entries
-  const allEntries = multipleEntries.flatMap((item) => {
-    if (item.type === 'nested') {
-      return item.entries;
-    }
-    return item;
-  });
-
-  return allEntries.some((builderEntry) => hasEntryEscaping(builderEntry, osTypes));
-};
+): boolean =>
+  flattenExceptionEntries(items).some((builderEntry) => hasEntryEscaping(builderEntry, osTypes));
 
 export const hasEntryEscaping = (
   builderEntry: BuilderEntry,
@@ -1104,6 +1098,29 @@ export const hasEntryEscaping = (
   );
 };
 
+// Detect `matches` entries with escaped wildcard metacharacters (\* or \?). Uses a negative
+// lookbehind so that \\* (double-backslash path separator + wildcard) does not trigger — only
+// a lone \* or \? (escaped metacharacter) fires the warning.
+const ESCAPED_WILDCARD_REGEX = /(?<!\\)\\[*?]/;
+
+export const getMalformedMatchesFields = (
+  items: ExceptionsBuilderReturnExceptionItem[]
+): string[] => {
+  const flattenedEntries = flattenExceptionEntries(items);
+
+  return flattenedEntries.reduce<string[]>((result, builderEntry) => {
+    if (
+      isWildcardStringEntry(builderEntry) &&
+      builderEntry.field !== '' &&
+      ESCAPED_WILDCARD_REGEX.test(builderEntry.value)
+    ) {
+      return [...result, builderEntry.field];
+    }
+
+    return result;
+  }, []);
+};
+
 /**
  * Event filters helper where given an exceptions list,
  * determine if both 'subject_name' and 'trusted' are