[Bug] KQL syntax error w/ Space between wildcard keywords

[imays11]

Describe the Bug

event.dataset: "aws.cloudtrail"
    and user_agent.original: (*S3 Browser* or *Cyberduck*)
    and event.outcome: "success"

When running this query in Kibana, I get the intended results with no errors.

However, when I use this query in my detection rule, the space between S3 and Browser throws an error with our unit tests. I do not get the same error when I add a wildcard between the two *S3*Browser* but in production this will result in false positives so is not a viable solution.

To Reproduce

Run our unit tests against a KQL query with wildcards and a space between words.

Expected Behavior

I expect that this syntax be validated by our unit tests since it is valid in Kibana.

Additional Context

PR in question :

• [New Rule] AWS API Activity from Uncommon S3 Client by Rare User #5694