semantic analysis: match variable encoded_value is not assigned to an event field - help required

[Cyber_Chief1999]

Hi all,

I am having an issue with the error message in the title field and some help would be really appreciated.

I have wrote a YARA-L rule in Chronicle which captures various matching powershell command and decodes the successful match using the strings.base64.decode function. I followed the guidance on (https://chronicle.security/blog/posts/new-to-chronicle-capturing-strings-for-additional-analysis/) and also created a shortened version of my base rule to test the syntax and it worked absolutely fine. Yet when i try and save the main master rule (below), i receive an error which after troubleshooting has not progressed much.  Any help on why the encoded_value variable needs assigning to a placeholder would be helpful, despite the fact i have used the exact same line in a much shorter detection rule without an error.

To summarise, the rule is looking for the presence of base64 strings used in command line and then capturing those true positive strings and assigning to a variable called encoded_value.

Many thanks