diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/AlertsFoundBadge.tsx b/keep-ui/app/(keep)/rules/CorrelationSidebar/AlertsFoundBadge.tsx
index 93cd6a0cc7..3bf7467293 100644
--- a/keep-ui/app/(keep)/rules/CorrelationSidebar/AlertsFoundBadge.tsx
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/AlertsFoundBadge.tsx
@@ -3,12 +3,14 @@ import { AlertDto } from "@/entities/alerts/model";
 import { DynamicImageProviderIcon } from "@/components/ui";
 
 type AlertsFoundBadgeProps = {
+  totalAlertsFound: number;
   alertsFound: AlertDto[];
   isLoading: boolean;
   role: "ruleCondition" | "correlationRuleConditions";
 };
 
 export const AlertsFoundBadge = ({
+  totalAlertsFound,
   alertsFound,
   isLoading,
   role,
@@ -17,15 +19,15 @@ export const AlertsFoundBadge = ({
     if (role === "ruleCondition") {
       return (
         <>
-          {alertsFound.length} alert{alertsFound.length > 1 ? "s" : ""} were
-          found matching this condition
+          {totalAlertsFound} alert{totalAlertsFound > 1 ? "s" : ""} were found
+          matching this condition
         </>
       );
     }
 
     return (
       <>
-        {alertsFound.length} alert{alertsFound.length > 1 ? "s" : ""} were found
+        {totalAlertsFound} alert{totalAlertsFound > 1 ? "s" : ""} were found
         matching correlation rule conditions
       </>
     );
@@ -39,7 +41,7 @@ export const AlertsFoundBadge = ({
     return "No alerts were found with these correlation rule conditions. Please try something else.";
   }
 
-  if (alertsFound.length === 0) {
+  if (totalAlertsFound === 0) {
     return (
       <Badge className="mt-3 w-full" color="gray">
         {isLoading ? "Getting your alerts..." : getNotFoundText()}
diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/CorrelationSidebarBody.tsx b/keep-ui/app/(keep)/rules/CorrelationSidebar/CorrelationSidebarBody.tsx
index 4e75371920..634cff5047 100644
--- a/keep-ui/app/(keep)/rules/CorrelationSidebar/CorrelationSidebarBody.tsx
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/CorrelationSidebarBody.tsx
@@ -10,13 +10,13 @@ import { Link } from "@/components/ui";
 import { ArrowUpRightIcon } from "@heroicons/react/24/outline";
 import { useRules } from "utils/hooks/useRules";
 import { useRouter, useSearchParams } from "next/navigation";
-import { useSearchAlerts } from "utils/hooks/useSearchAlerts";
 import { AlertsFoundBadge } from "./AlertsFoundBadge";
 import { useApi } from "@/shared/lib/hooks/useApi";
 import { useConfig } from "@/utils/hooks/useConfig";
 import { showErrorToast } from "@/shared/ui";
 import { CorrelationFormType } from "./types";
 import { TIMEFRAME_UNITS_TO_SECONDS } from "./timeframe-constants";
+import { useMatchingAlerts } from "./useMatchingAlerts";
 
 type CorrelationSidebarBodyProps = {
   toggle: VoidFunction;
@@ -46,10 +46,11 @@ export const CorrelationSidebarBody = ({
   const searchParams = useSearchParams();
   const selectedId = searchParams ? searchParams.get("id") : null;
 
-  const { data: alertsFound = [], isLoading } = useSearchAlerts({
-    query: methods.watch("query"),
-    timeframe: timeframeInSeconds,
-  });
+  const {
+    data: alertsFound = [],
+    totalCount: totalAlertsFound,
+    isLoading,
+  } = useMatchingAlerts(methods.watch("query"));
 
   const [isCalloutShown, setIsCalloutShown] = useLocalStorage(
     "correlation-callout",
@@ -85,7 +86,7 @@ export const CorrelationSidebarBody = ({
       celQuery: formatQuery(query, "cel"),
       timeframeInSeconds,
       timeUnit: timeUnit,
-      groupingCriteria: alertsFound.length ? groupedAttributes : [],
+      groupingCriteria: totalAlertsFound ? groupedAttributes : [],
       requireApprove: requireApprove,
       resolveOn: resolveOn,
       createOn: createOn,
@@ -169,8 +170,9 @@ export const CorrelationSidebarBody = ({
             <CorrelationGroups />
           </div>
           <div className="flex flex-col border-t-2">
-            {alertsFound.length > 0 && (
+            {totalAlertsFound > 0 && (
               <AlertsFoundBadge
+                totalAlertsFound={totalAlertsFound}
                 alertsFound={alertsFound}
                 isLoading={false}
                 role={"correlationRuleConditions"}
diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/RuleFields.tsx b/keep-ui/app/(keep)/rules/CorrelationSidebar/RuleFields.tsx
index e49bf83b96..67cf2075ab 100644
--- a/keep-ui/app/(keep)/rules/CorrelationSidebar/RuleFields.tsx
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/RuleFields.tsx
@@ -18,11 +18,11 @@ import {
 } from "react-querybuilder";
 import { AlertsFoundBadge } from "./AlertsFoundBadge";
 import { useFormContext } from "react-hook-form";
-import { useSearchAlerts } from "utils/hooks/useSearchAlerts";
 import { CorrelationFormType } from "./types";
 import { TIMEFRAME_UNITS_TO_SECONDS } from "./timeframe-constants";
 import { useDeduplicationFields } from "@/utils/hooks/useDeduplicationRules";
 import { get } from "lodash";
+import { useMatchingAlerts } from "./useMatchingAlerts";
 
 const DEFAULT_OPERATORS = defaultOperators.filter((operator) =>
   [
@@ -50,7 +50,7 @@ const OPERATORS_FORCE_TYPE_CAST = {
   "<=": "number",
   "<": "number",
   ">": "number",
-}
+};
 
 const DEFAULT_FIELDS: QueryField[] = [
   { name: "source", label: "source", datatype: "text" },
@@ -117,9 +117,13 @@ const Field = ({
   };
 
   const castValueToOperationType = (value: string) => {
-    const castTo: string = get(OPERATORS_FORCE_TYPE_CAST, ruleField.operator, "text");
+    const castTo: string = get(
+      OPERATORS_FORCE_TYPE_CAST,
+      ruleField.operator,
+      "text"
+    );
     return castTo === "number" ? Number(value) : value;
-  }
+  };
 
   return (
     <div key={ruleField.id}>
@@ -158,7 +162,9 @@ const Field = ({
           {isValueEnabled && (
             <div>
               <TextInput
-                onValueChange={(newValue) => onFieldChange("value", castValueToOperationType(newValue))}
+                onValueChange={(newValue) =>
+                  onFieldChange("value", castValueToOperationType(newValue))
+                }
                 defaultValue={ruleField.value}
                 required
                 error={!ruleField.value}
@@ -279,10 +285,11 @@ export const RuleFields = ({
     ? TIMEFRAME_UNITS_TO_SECONDS[watch("timeUnit")](+watch("timeAmount"))
     : 0;
 
-  const { data: alertsFound = [], isLoading } = useSearchAlerts({
-    query: { combinator: "and", rules: ruleFields },
-    timeframe: timeframeInSeconds,
-  });
+  const {
+    data: alertsFound = [],
+    totalCount: totalAlertsFound,
+    isLoading,
+  } = useMatchingAlerts({ combinator: "and", rules: ruleFields });
 
   return (
     <div key={rule.id} className="bg-gray-100 px-4 py-3 rounded space-y-2">
@@ -346,6 +353,7 @@ export const RuleFields = ({
         </div>
 
         <AlertsFoundBadge
+          totalAlertsFound={totalAlertsFound}
           alertsFound={alertsFound}
           isLoading={isLoading}
           role={"ruleCondition"}
diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function.test.ts b/keep-ui/app/(keep)/rules/CorrelationSidebar/convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function.test.ts
new file mode 100644
index 0000000000..c220a662d8
--- /dev/null
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function.test.ts
@@ -0,0 +1,233 @@
+import { convertCelAstToQueryBuilderAst } from "./convert-cel-ast-to-query-builder-ast.function";
+import { CelAst } from "@/utils/cel-ast";
+
+describe("convertCelAstToQueryBuilderAst", () => {
+  it("should convert a LogicalNode with AND operator", () => {
+    const logicalNode: CelAst.LogicalNode = {
+      node_type: "LogicalNode",
+      operator: CelAst.LogicalNodeOperator.AND,
+      left: {
+        node_type: "ComparisonNode",
+        first_operand: { path: ["field1"] } as CelAst.PropertyAccessNode,
+        operator: CelAst.ComparisonNodeOperator.EQ,
+        second_operand: { value: "value1" },
+      } as CelAst.ComparisonNode,
+      right: {
+        node_type: "ComparisonNode",
+        first_operand: { path: ["field2"] } as CelAst.PropertyAccessNode,
+        operator: CelAst.ComparisonNodeOperator.NE,
+        second_operand: { value: "value2" },
+      } as CelAst.ComparisonNode,
+    };
+
+    const result = convertCelAstToQueryBuilderAst(logicalNode);
+
+    expect(result).toEqual({
+      combinator: "and",
+      rules: [
+        {
+          field: "field1",
+          operator: "=",
+          value: "value1",
+          id: expect.any(String),
+        },
+        {
+          field: "field2",
+          operator: "!=",
+          value: "value2",
+          id: expect.any(String),
+        },
+      ],
+    });
+  });
+
+  it("should convert a LogicalNode with OR operator", () => {
+    const logicalNode: CelAst.LogicalNode = {
+      node_type: "LogicalNode",
+      operator: CelAst.LogicalNodeOperator.OR,
+      left: {
+        node_type: "ComparisonNode",
+        first_operand: { path: ["field1"] } as CelAst.PropertyAccessNode,
+        operator: CelAst.ComparisonNodeOperator.GT,
+        second_operand: { value: 10 },
+      } as CelAst.ComparisonNode,
+      right: {
+        node_type: "ComparisonNode",
+        first_operand: { path: ["field2"] } as CelAst.PropertyAccessNode,
+        operator: CelAst.ComparisonNodeOperator.LT,
+        second_operand: { value: 20 },
+      } as CelAst.ComparisonNode,
+    };
+
+    const result = convertCelAstToQueryBuilderAst(logicalNode);
+
+    expect(result).toEqual({
+      combinator: "or",
+      rules: [
+        {
+          field: "field1",
+          operator: ">",
+          value: 10,
+          id: expect.any(String),
+        },
+        {
+          field: "field2",
+          operator: "<",
+          value: 20,
+          id: expect.any(String),
+        },
+      ],
+    });
+  });
+
+  it("should convert a ComparisonNode with EQ operator and null value to 'null' operator", () => {
+    const comparisonNode: CelAst.ComparisonNode = {
+      node_type: "ComparisonNode",
+      first_operand: { path: ["field1"] } as CelAst.PropertyAccessNode,
+      operator: CelAst.ComparisonNodeOperator.EQ,
+      second_operand: { value: null },
+    };
+
+    const result = convertCelAstToQueryBuilderAst(comparisonNode);
+
+    expect(result).toEqual({
+      combinator: "and",
+      rules: [
+        {
+          field: "field1",
+          operator: "null",
+          id: expect.any(String),
+        },
+      ],
+    });
+  });
+
+  it.each([
+    [CelAst.ComparisonNodeOperator.EQ, "="],
+    [CelAst.ComparisonNodeOperator.NE, "!="],
+    [CelAst.ComparisonNodeOperator.CONTAINS, "contains"],
+    [CelAst.ComparisonNodeOperator.STARTS_WITH, "beginsWith"],
+    [CelAst.ComparisonNodeOperator.ENDS_WITH, "endsWith"],
+  ])(
+    "should convert %s operator to %s",
+    (celOperator, queryBuilderOperator) => {
+      const comparisonNode: CelAst.ComparisonNode = {
+        node_type: "ComparisonNode",
+        first_operand: {
+          path: ["field1", "field2"],
+        } as CelAst.PropertyAccessNode,
+        operator: celOperator,
+        second_operand: { value: "testValue" },
+      };
+
+      const result = convertCelAstToQueryBuilderAst(comparisonNode);
+
+      expect(result).toEqual({
+        combinator: "and",
+        rules: [
+          {
+            field: "field1.field2",
+            operator: queryBuilderOperator,
+            value: "testValue",
+            id: expect.any(String),
+          },
+        ],
+      });
+    }
+  );
+
+  it("should convert a ComparisonNode with NE operator and null value to 'notNull' operator", () => {
+    const comparisonNode: CelAst.ComparisonNode = {
+      node_type: "ComparisonNode",
+      first_operand: {
+        path: ["field1", "field2"],
+      } as CelAst.PropertyAccessNode,
+      operator: CelAst.ComparisonNodeOperator.NE,
+      second_operand: { value: null },
+    };
+
+    const result = convertCelAstToQueryBuilderAst(comparisonNode);
+
+    expect(result).toEqual({
+      combinator: "and",
+      rules: [
+        {
+          field: "field1.field2",
+          operator: "notNull",
+          id: expect.any(String),
+        },
+      ],
+    });
+  });
+
+  it("should convert a UnaryNode with NOT IN operator to notIn opearator", () => {
+    const unaryNode: CelAst.UnaryNode = {
+      node_type: "UnaryNode",
+      operator: CelAst.UnaryNodeOperator.NOT,
+      operand: {
+        node_type: "ComparisonNode",
+        first_operand: { path: ["field1"] } as CelAst.PropertyAccessNode,
+        operator: CelAst.ComparisonNodeOperator.IN,
+        second_operand: { value: [1, 2, 3] },
+      } as CelAst.ComparisonNode,
+    };
+
+    const result = convertCelAstToQueryBuilderAst(unaryNode);
+
+    expect(result).toEqual({
+      combinator: "and",
+      rules: [
+        {
+          field: "field1",
+          operator: "notIn",
+          value: [1, 2, 3],
+          id: expect.any(String),
+        },
+      ],
+    });
+  });
+
+  it.each([
+    [CelAst.ComparisonNodeOperator.CONTAINS, "doesNotContain"],
+    [CelAst.ComparisonNodeOperator.STARTS_WITH, "doesNotBeginWith"],
+    [CelAst.ComparisonNodeOperator.ENDS_WITH, "doesNotEndWith"],
+  ])(
+    "should convert unary not with %s operator to %s operator",
+    (celOperator, queryBuilderOperator) => {
+      const unaryNode: CelAst.UnaryNode = {
+        node_type: "UnaryNode",
+        operator: CelAst.UnaryNodeOperator.NOT,
+        operand: {
+          node_type: "ComparisonNode",
+          first_operand: { path: ["field1"] } as CelAst.PropertyAccessNode,
+          operator: celOperator,
+          second_operand: { value: "testValue" },
+        } as CelAst.ComparisonNode,
+      };
+
+      const result = convertCelAstToQueryBuilderAst(unaryNode);
+
+      expect(result).toEqual({
+        combinator: "and",
+        rules: [
+          {
+            field: "field1",
+            operator: queryBuilderOperator,
+            value: "testValue",
+            id: expect.any(String),
+          },
+        ],
+      });
+    }
+  );
+
+  it("should throw an error for unsupported node type", () => {
+    const unsupportedNode: any = {
+      node_type: "UnsupportedNode",
+    };
+
+    expect(() => convertCelAstToQueryBuilderAst(unsupportedNode)).toThrow(
+      "Unsupported node type: UnsupportedNode"
+    );
+  });
+});
diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function.ts b/keep-ui/app/(keep)/rules/CorrelationSidebar/convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function.ts
new file mode 100644
index 0000000000..f255f236ce
--- /dev/null
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function.ts
@@ -0,0 +1,176 @@
+import { v4 as uuidv4 } from "uuid";
+import { CelAst } from "@/utils/cel-ast";
+import { DefaultRuleGroupType } from "react-querybuilder";
+
+function mapOperator(op: string): string {
+  switch (op) {
+    case "==":
+      return "=";
+    case "!=":
+      return "!=";
+    case ">":
+      return ">";
+    case "<":
+      return "<";
+    case ">=":
+      return ">=";
+    case "<=":
+      return "<=";
+    case "contains":
+      return "contains";
+    case "startsWith":
+      return "beginsWith";
+    case "endsWith":
+      return "endsWith";
+    default:
+      return op;
+  }
+}
+
+function visitUnaryNode(node: CelAst.UnaryNode): DefaultRuleGroupType {
+  if (node.operator !== CelAst.UnaryNodeOperator.NOT) {
+    throw new Error("Unsupported operator: " + node.operator);
+  }
+
+  let operand = (node as CelAst.UnaryNode).operand;
+
+  if (operand?.node_type === "ParenthesisNode") {
+    operand = (operand as CelAst.ParenthesisNode).expression;
+  }
+
+  if (operand?.node_type === "ComparisonNode") {
+    const field = (
+      (operand as CelAst.ComparisonNode)
+        .first_operand as CelAst.PropertyAccessNode
+    )?.path.join(".");
+    const value = (
+      (operand as CelAst.ComparisonNode).second_operand as CelAst.ConstantNode
+    )?.value;
+    let operator: string = "";
+    switch ((operand as CelAst.ComparisonNode).operator) {
+      case CelAst.ComparisonNodeOperator.IN:
+        operator = "notIn";
+        break;
+      case CelAst.ComparisonNodeOperator.CONTAINS:
+        operator = "doesNotContain";
+        break;
+      case CelAst.ComparisonNodeOperator.STARTS_WITH:
+        operator = "doesNotBeginWith";
+        break;
+      case CelAst.ComparisonNodeOperator.ENDS_WITH:
+        operator = "doesNotEndWith";
+        break;
+    }
+
+    return {
+      combinator: "and",
+      rules: [
+        {
+          field,
+          operator,
+          value,
+          id: uuidv4(),
+        } as any,
+      ],
+    };
+  }
+
+  throw new Error("UnaryNode with unknown operand: " + node.node_type);
+}
+
+function visitComparisonNode(
+  node: CelAst.ComparisonNode
+): DefaultRuleGroupType {
+  const field = (
+    (node as CelAst.ComparisonNode).first_operand as CelAst.PropertyAccessNode
+  )?.path.join(".");
+  const operator = (node as CelAst.ComparisonNode).operator;
+  const value = (
+    (node as CelAst.ComparisonNode).second_operand as CelAst.ConstantNode
+  )?.value;
+  let queryBuilderField = null;
+
+  if (operator == CelAst.ComparisonNodeOperator.NE && value == null) {
+    queryBuilderField = {
+      field,
+      operator: "notNull",
+      id: uuidv4(),
+    } as any;
+  } else if (operator == CelAst.ComparisonNodeOperator.EQ && value == null) {
+    queryBuilderField = {
+      field,
+      operator: "null",
+      id: uuidv4(),
+    } as any;
+  } else {
+    queryBuilderField = {
+      field,
+      operator: mapOperator((node as CelAst.ComparisonNode).operator),
+      value,
+      id: uuidv4(),
+    } as any;
+  }
+
+  return {
+    combinator: "and",
+    rules: [queryBuilderField],
+  };
+}
+
+function visitLogicalNode(node: CelAst.LogicalNode): DefaultRuleGroupType {
+  const left = convertCelAstToQueryBuilderAst(
+    ((node as CelAst.LogicalNode).left as any).expression ??
+      (node as CelAst.LogicalNode).left
+  );
+  const right = convertCelAstToQueryBuilderAst(
+    ((node as CelAst.LogicalNode).right as any).expression ??
+      (node as CelAst.LogicalNode).right
+  );
+  const combinator =
+    (node as CelAst.LogicalNode).operator === CelAst.LogicalNodeOperator.OR
+      ? "or"
+      : "and";
+
+  const rules = [];
+
+  if (left.combinator == combinator || left.rules.length <= 1) {
+    rules.push(...left.rules);
+  } else {
+    rules.push(left);
+  }
+
+  if (right.combinator == combinator || right.rules.length <= 1) {
+    rules.push(...right.rules);
+  } else {
+    rules.push(right);
+  }
+
+  return {
+    combinator,
+    rules: rules,
+  };
+}
+
+export function convertCelAstToQueryBuilderAst(
+  node: CelAst.Node
+): DefaultRuleGroupType {
+  switch (node.node_type) {
+    case "LogicalNode": {
+      return visitLogicalNode(node as CelAst.LogicalNode);
+    }
+    case "ParenthesisNode": {
+      return convertCelAstToQueryBuilderAst(
+        (node as CelAst.ParenthesisNode).expression
+      );
+    }
+    case "ComparisonNode": {
+      return visitComparisonNode(node as CelAst.ComparisonNode);
+    }
+    case "UnaryNode": {
+      return visitUnaryNode(node as CelAst.UnaryNode);
+    }
+
+    default:
+      throw new Error(`Unsupported node type: ${node.node_type}`);
+  }
+}
diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/index.tsx b/keep-ui/app/(keep)/rules/CorrelationSidebar/index.tsx
index 0a57ca4903..e2dc3d378e 100644
--- a/keep-ui/app/(keep)/rules/CorrelationSidebar/index.tsx
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/index.tsx
@@ -1,9 +1,18 @@
-import { Fragment } from "react";
-import { Dialog, Transition } from "@headlessui/react";
+import { useMemo } from "react";
 import { CorrelationSidebarHeader } from "./CorrelationSidebarHeader";
 import { CorrelationSidebarBody } from "./CorrelationSidebarBody";
 import { CorrelationFormType } from "./types";
 import { Drawer } from "@/shared/ui/Drawer";
+import { Rule } from "@/utils/hooks/useRules";
+import { DefaultRuleGroupType, parseCEL } from "react-querybuilder";
+import { convertCelAstToQueryBuilderAst } from "./convert-cel-ast-to-query-builder-ast/convert-cel-ast-to-query-builder-ast.function";
+
+const TIMEFRAME_UNITS_FROM_SECONDS = {
+  seconds: (amount: number) => amount,
+  minutes: (amount: number) => amount / 60,
+  hours: (amount: number) => amount / 3600,
+  days: (amount: number) => amount / 86400,
+} as const;
 
 export const DEFAULT_CORRELATION_FORM_VALUES: CorrelationFormType = {
   name: "",
@@ -36,22 +45,72 @@ export const DEFAULT_CORRELATION_FORM_VALUES: CorrelationFormType = {
 type CorrelationSidebarProps = {
   isOpen: boolean;
   toggle: VoidFunction;
+  selectedRule?: Rule;
   defaultValue?: CorrelationFormType;
 };
 
 export const CorrelationSidebar = ({
   isOpen,
   toggle,
-  defaultValue = DEFAULT_CORRELATION_FORM_VALUES,
-}: CorrelationSidebarProps) => (
-  <Drawer
-    isOpen={isOpen}
-    onClose={toggle}
-    className="fixed right-0 inset-y-0 min-w-12 bg-white p-6 overflow-auto flex flex-col"
-  >
-    <div className="flex flex-col h-full max-h-full overflow-hidden">
-      <CorrelationSidebarHeader toggle={toggle} />
-      <CorrelationSidebarBody toggle={toggle} defaultValue={defaultValue} />
-    </div>
-  </Drawer>
-);
+  selectedRule,
+}: CorrelationSidebarProps) => {
+  const correlationFormFromRule: CorrelationFormType = useMemo(() => {
+    if (selectedRule) {
+      const query = convertCelAstToQueryBuilderAst(
+        selectedRule.definition_cel_ast
+      );
+      const anyCombinator = query.rules?.some((rule) => "combinator" in rule);
+
+      const queryInGroup: DefaultRuleGroupType = {
+        ...query,
+        rules: anyCombinator
+          ? query.rules
+          : [
+              {
+                combinator: "and",
+                rules: query.rules,
+              },
+            ],
+      };
+
+      const timeunit = selectedRule.timeunit ?? "seconds";
+
+      return {
+        name: selectedRule.name,
+        description: selectedRule.group_description ?? "",
+        timeAmount: TIMEFRAME_UNITS_FROM_SECONDS[timeunit](
+          selectedRule.timeframe
+        ),
+        timeUnit: timeunit,
+        groupedAttributes: selectedRule.grouping_criteria,
+        requireApprove: selectedRule.require_approve,
+        resolveOn: selectedRule.resolve_on,
+        createOn: selectedRule.create_on,
+        query: queryInGroup,
+        incidents: selectedRule.incidents,
+        incidentNameTemplate: selectedRule.incident_name_template || "",
+        incidentPrefix: selectedRule.incident_prefix || "",
+        multiLevel: selectedRule.multi_level,
+        multiLevelPropertyName: selectedRule.multi_level_property_name || "",
+      };
+    }
+
+    return DEFAULT_CORRELATION_FORM_VALUES;
+  }, [selectedRule]);
+
+  return (
+    <Drawer
+      isOpen={isOpen}
+      onClose={toggle}
+      className="fixed right-0 inset-y-0 min-w-12 bg-white p-6 overflow-auto flex flex-col"
+    >
+      <div className="flex flex-col h-full max-h-full overflow-hidden">
+        <CorrelationSidebarHeader toggle={toggle} />
+        <CorrelationSidebarBody
+          toggle={toggle}
+          defaultValue={correlationFormFromRule}
+        />
+      </div>
+    </Drawer>
+  );
+};
diff --git a/keep-ui/app/(keep)/rules/CorrelationSidebar/useMatchingAlerts.ts b/keep-ui/app/(keep)/rules/CorrelationSidebar/useMatchingAlerts.ts
new file mode 100644
index 0000000000..1dce2e73e1
--- /dev/null
+++ b/keep-ui/app/(keep)/rules/CorrelationSidebar/useMatchingAlerts.ts
@@ -0,0 +1,21 @@
+import { AlertsQuery, useAlerts } from "@/entities/alerts/model";
+import { useDebouncedValue } from "@/utils/hooks/useDebouncedValue";
+import { useEffect, useState } from "react";
+import { formatQuery, RuleGroupType } from "react-querybuilder";
+
+export function useMatchingAlerts(rules: RuleGroupType | undefined) {
+  const { useLastAlerts } = useAlerts();
+  const [debouncedRules] = useDebouncedValue(rules, 2000);
+  const [alertsQuery, setAlertsQuery] = useState<AlertsQuery>();
+  useEffect(() => {
+    if (rules) {
+      setAlertsQuery({
+        cel: formatQuery(debouncedRules as RuleGroupType, "cel"),
+        limit: 1000,
+        offset: 0,
+      });
+    }
+  }, [debouncedRules]);
+
+  return useLastAlerts(alertsQuery);
+}
diff --git a/keep-ui/app/(keep)/rules/CorrelationTable.tsx b/keep-ui/app/(keep)/rules/CorrelationTable.tsx
index 78df736abb..88835ba798 100644
--- a/keep-ui/app/(keep)/rules/CorrelationTable.tsx
+++ b/keep-ui/app/(keep)/rules/CorrelationTable.tsx
@@ -2,7 +2,6 @@ import {
   Badge,
   Button,
   Card,
-  Icon,
   Table,
   TableBody,
   TableCell,
@@ -10,34 +9,21 @@ import {
   TableHeaderCell,
   TableRow,
 } from "@tremor/react";
-import { useEffect, useMemo, useState } from "react";
+import { useMemo, useState } from "react";
 import { Rule } from "utils/hooks/useRules";
-import {
-  CorrelationSidebar,
-  DEFAULT_CORRELATION_FORM_VALUES,
-} from "./CorrelationSidebar";
+import { CorrelationSidebar } from "./CorrelationSidebar";
 import {
   createColumnHelper,
   flexRender,
   getCoreRowModel,
   useReactTable,
 } from "@tanstack/react-table";
-import { DefaultRuleGroupType } from "react-querybuilder";
-import { parseCEL } from "react-querybuilder/parseCEL";
 import { useRouter, useSearchParams } from "next/navigation";
-import { FormattedQueryCell } from "./FormattedQueryCell";
 import { DeleteRuleCell } from "./CorrelationSidebar/DeleteRule";
-import { CorrelationFormType } from "./CorrelationSidebar/types";
 import { PageSubtitle, PageTitle } from "@/shared/ui";
 import { PlusIcon } from "@heroicons/react/20/solid";
 import { GroupedByCell } from "./GroupedByCel";
-
-const TIMEFRAME_UNITS_FROM_SECONDS = {
-  seconds: (amount: number) => amount,
-  minutes: (amount: number) => amount / 60,
-  hours: (amount: number) => amount / 3600,
-  days: (amount: number) => amount / 86400,
-} as const;
+import CelInput from "@/features/cel-input/cel-input";
 
 const columnHelper = createColumnHelper<Rule>();
 
@@ -51,47 +37,6 @@ export const CorrelationTable = ({ rules }: CorrelationTableProps) => {
 
   const selectedId = searchParams ? searchParams.get("id") : null;
   const selectedRule = rules.find((rule) => rule.id === selectedId);
-  const correlationFormFromRule: CorrelationFormType = useMemo(() => {
-    if (selectedRule) {
-      const query = parseCEL(selectedRule.definition_cel);
-      const anyCombinator = query.rules.some((rule) => "combinator" in rule);
-
-      const queryInGroup: DefaultRuleGroupType = {
-        ...query,
-        rules: anyCombinator
-          ? query.rules
-          : [
-              {
-                combinator: "and",
-                rules: query.rules,
-              },
-            ],
-      };
-
-      const timeunit = selectedRule.timeunit ?? "seconds";
-
-      return {
-        name: selectedRule.name,
-        description: selectedRule.group_description ?? "",
-        timeAmount: TIMEFRAME_UNITS_FROM_SECONDS[timeunit](
-          selectedRule.timeframe
-        ),
-        timeUnit: timeunit,
-        groupedAttributes: selectedRule.grouping_criteria,
-        requireApprove: selectedRule.require_approve,
-        resolveOn: selectedRule.resolve_on,
-        createOn: selectedRule.create_on,
-        query: queryInGroup,
-        incidents: selectedRule.incidents,
-        incidentNameTemplate: selectedRule.incident_name_template || "",
-        incidentPrefix: selectedRule.incident_prefix || "",
-        multiLevel: selectedRule.multi_level,
-        multiLevelPropertyName: selectedRule.multi_level_property_name || "",
-      };
-    }
-
-    return DEFAULT_CORRELATION_FORM_VALUES;
-  }, [selectedRule]);
 
   const [isRuleCreation, setIsRuleCreation] = useState(false);
 
@@ -141,9 +86,20 @@ export const CorrelationTable = ({ rules }: CorrelationTableProps) => {
       }),
       columnHelper.accessor("definition_cel", {
         header: "Description",
-        cell: (context) => (
-          <FormattedQueryCell query={parseCEL(context.getValue())} />
-        ),
+        cell: (context) => {
+          let cel = context.getValue();
+
+          return (
+            <div
+              onClick={(e) => {
+                e.preventDefault();
+                e.stopPropagation();
+              }}
+            >
+              <CelInput readOnly={true} value={cel}></CelInput>
+            </div>
+          );
+        },
       }),
       columnHelper.accessor("grouping_criteria", {
         header: "Grouped by",
@@ -233,7 +189,7 @@ export const CorrelationTable = ({ rules }: CorrelationTableProps) => {
         <CorrelationSidebar
           isOpen={true}
           toggle={onCloseCorrelation}
-          defaultValue={correlationFormFromRule}
+          selectedRule={selectedRule}
         />
       )}
     </div>
diff --git a/keep-ui/app/(keep)/rules/FormattedQueryCell.tsx b/keep-ui/app/(keep)/rules/FormattedQueryCell.tsx
deleted file mode 100644
index 6f54ddfe54..0000000000
--- a/keep-ui/app/(keep)/rules/FormattedQueryCell.tsx
+++ /dev/null
@@ -1,102 +0,0 @@
-import { PlusIcon } from "@radix-ui/react-icons";
-import { Badge, Icon } from "@tremor/react";
-import { Fragment } from "react";
-import { RuleGroupArray, RuleGroupType, RuleType } from "react-querybuilder";
-import * as Tooltip from "@radix-ui/react-tooltip";
-
-type FormattedQueryCellProps = {
-  query: RuleGroupType;
-};
-
-export const FormattedQueryCell = ({ query }: FormattedQueryCellProps) => {
-  let displayedRules: any[] = query.rules;
-  let rulesInTooltip: any[] = [];
-
-  if (query.rules.length > 2) {
-    displayedRules = query.rules.slice(0, 1);
-    rulesInTooltip = query.rules.slice(1);
-  }
-
-  // tb: this is a patch to make it work, needs refactor
-  const anyCombinator = query.rules.some((rule) => "combinator" in rule);
-
-  function renderRules(
-    rules: RuleGroupArray<
-      RuleGroupType<RuleType<string, string, any, string>, string>,
-      RuleType<string, string, any, string>
-    >
-  ): JSX.Element[] | JSX.Element {
-    return anyCombinator ? (
-      rules.map((group, groupI) => (
-        <Fragment key={groupI}>
-          <div className="px-2 py-1 bg-gray-50 border rounded space-x-2">
-            {"combinator" in group
-              ? group.rules.map((rule, ruleI) => (
-                  <Fragment key={ruleI}>
-                    {"field" in rule ? (
-                      <span className="space-x-2">
-                        <b>{rule.field}</b>{" "}
-                        <code className="font-mono">{rule.operator}</code>
-                        <Badge color="orange" className="px-1 min-w-6">
-                          {rule.value}
-                        </Badge>
-                      </span>
-                    ) : undefined}
-                  </Fragment>
-                ))
-              : null}
-          </div>
-          {rules.length !== groupI + 1 && (
-            <Icon icon={PlusIcon} size="xs" color="slate" />
-          )}
-        </Fragment>
-      ))
-    ) : (
-      <Fragment>
-        <div className="p-2 bg-gray-50 border rounded space-x-2">
-          {rules.map((rule, ruleI) => {
-            return (
-              <Fragment key={ruleI}>
-                {"field" in rule ? (
-                  <span className="space-x-2">
-                    <b>{rule.field}</b>{" "}
-                    <code className="font-mono">{rule.operator}</code>
-                    {rule.value && <Badge color="orange">{rule.value}</Badge>}
-                  </span>
-                ) : undefined}
-              </Fragment>
-            );
-          })}
-        </div>
-      </Fragment>
-    );
-  }
-
-  return (
-    <div className="inline-flex items-center">
-      {renderRules(displayedRules)}
-      {rulesInTooltip.length > 0 && (
-        <>
-          <Icon icon={PlusIcon} size="xs" color="slate" />
-          <Tooltip.Provider>
-            <Tooltip.Root>
-              <Tooltip.Trigger asChild>
-                <span className="font-bold text-xs">
-                  {rulesInTooltip.length} more
-                </span>
-              </Tooltip.Trigger>
-              <Tooltip.Portal>
-                <Tooltip.Content sideOffset={5}>
-                  <div className="bg-white invert-dark-mode dark:bg-gray-50 border-gray-200 p-2 rounded inline-flex items-center">
-                    {renderRules(rulesInTooltip)}
-                  </div>
-                  <Tooltip.Arrow />
-                </Tooltip.Content>
-              </Tooltip.Portal>
-            </Tooltip.Root>
-          </Tooltip.Provider>
-        </>
-      )}
-    </div>
-  );
-};
diff --git a/keep-ui/app/(keep)/rules/flatten-cel-ast.ts b/keep-ui/app/(keep)/rules/flatten-cel-ast.ts
new file mode 100644
index 0000000000..daf5e89344
--- /dev/null
+++ b/keep-ui/app/(keep)/rules/flatten-cel-ast.ts
@@ -0,0 +1,9 @@
+// import { CelAst } from "@/utils/cel-ast";
+
+// interface  {
+//     first_operand
+// }
+
+// export function flattenCelAst(celAst:CelAst.Node): any {
+
+// }
diff --git a/keep-ui/entities/alerts/model/useAlerts.ts b/keep-ui/entities/alerts/model/useAlerts.ts
index 8ed0624987..21d747e648 100644
--- a/keep-ui/entities/alerts/model/useAlerts.ts
+++ b/keep-ui/entities/alerts/model/useAlerts.ts
@@ -171,7 +171,7 @@ export const useAlerts = () => {
     const requestUrl = `/alerts/query`;
     const swrKey = () =>
       // adding "/alerts/query" so global revalidation works
-      api.isReady()
+      api.isReady() && query
         ? requestUrl +
           Object.entries(queryToPost)
             .sort(([fstKey], [scdKey]) => fstKey.localeCompare(scdKey))
@@ -199,9 +199,9 @@ export const useAlerts = () => {
       data: swrValue.data?.queryResult?.results as AlertDto[],
       queryTimeInSeconds: swrValue.data?.queryTimeInSeconds,
       isLoading: swrValue.isLoading || !swrValue.data?.queryResult,
-      totalCount: swrValue.data?.queryResult?.count,
-      limit: swrValue.data?.queryResult?.limit,
-      offset: swrValue.data?.queryResult?.offset,
+      totalCount: swrValue.data?.queryResult?.count as number,
+      limit: swrValue.data?.queryResult?.limit as number,
+      offset: swrValue.data?.queryResult?.offset as number,
     };
   };
 
diff --git a/keep-ui/features/cel-input/cel-input.tsx b/keep-ui/features/cel-input/cel-input.tsx
index 19fb1fa725..aa99422941 100644
--- a/keep-ui/features/cel-input/cel-input.tsx
+++ b/keep-ui/features/cel-input/cel-input.tsx
@@ -3,6 +3,7 @@ import type { editor } from "monaco-editor";
 import { MonacoCelEditor } from "@/shared/ui/MonacoCELEditor";
 import { IoSearchOutline } from "react-icons/io5";
 import { TrashIcon, XMarkIcon } from "@heroicons/react/24/outline";
+import clsx from "clsx";
 
 interface CelInputProps {
   id?: string;
@@ -15,6 +16,7 @@ interface CelInputProps {
   onIsValidChange?: (isValid: boolean) => void;
   placeholder?: string;
   disabled?: boolean;
+  readOnly?: boolean;
 }
 
 const CelInput: FC<CelInputProps> = ({
@@ -27,28 +29,37 @@ const CelInput: FC<CelInputProps> = ({
   onKeyDown,
   onFocus,
   placeholder = "Enter value",
+  readOnly = false,
   disabled = false,
 }) => {
   return (
-    <div className="flex-1 h-9 border rounded-md pl-9 relative bg-white">
+    <div
+      className={clsx(
+        { "pl-2": readOnly, "pl-9": !readOnly },
+        "flex-1 h-9 border rounded-md relative bg-white"
+      )}
+    >
       <MonacoCelEditor
         editorId={id}
         className="h-20 relative {}"
         value={value}
+        readOnly={readOnly}
         fieldsForSuggestions={fieldsForSuggestions}
         onValueChange={onValueChange || ((value: string) => {})}
         onIsValidChange={onIsValidChange}
         onKeyDown={onKeyDown}
         onFocus={onFocus}
       />
-      <IoSearchOutline className="absolute left-3 top-1/2 transform -translate-y-1/2 text-gray-400 h-4 w-4" />
+      {!readOnly && (
+        <IoSearchOutline className="absolute left-3 top-1/2 transform -translate-y-1/2 text-gray-400 h-4 w-4" />
+      )}
 
       {placeholder && !value && (
         <div className="pointer-events-none absolute top-0 w-full h-full flex items-center text-sm text-gray-900 text-opacity-50">
           {placeholder}
         </div>
       )}
-      {value && (
+      {!readOnly && value && (
         <button
           onClick={onClearValue}
           className="absolute top-0 right-0 w-9 h-full flex items-center justify-center text-gray-400 hover:text-gray-600" // Position to the left of the Enter to apply badge
diff --git a/keep-ui/shared/ui/MonacoCELEditor/monaco-cel-editor.tsx b/keep-ui/shared/ui/MonacoCELEditor/monaco-cel-editor.tsx
index fcd2e2757e..c7d995ec5b 100644
--- a/keep-ui/shared/ui/MonacoCELEditor/monaco-cel-editor.tsx
+++ b/keep-ui/shared/ui/MonacoCELEditor/monaco-cel-editor.tsx
@@ -16,6 +16,7 @@ interface MonacoCelProps {
   className: string;
   value: string;
   fieldsForSuggestions?: string[];
+  readOnly?: boolean;
   onIsValidChange?: (isValid: boolean) => void;
   onValueChange: (value: string) => void;
   onKeyDown?: (e: KeyboardEvent) => void;
@@ -43,7 +44,7 @@ export function MonacoCelEditor(props: MonacoCelProps) {
   const suggestionsShownRef = useRef<boolean>();
   const [value, setValue] = useState<string>(props.value);
 
-  const validationErrors = useCelValidation(value);
+  const validationErrors = useCelValidation(props.readOnly ? undefined : value);
 
   useEffect(() => {
     if (!isEditorMounted) {
@@ -75,6 +76,26 @@ export function MonacoCelEditor(props: MonacoCelProps) {
     }
   }, [props.fieldsForSuggestions, props.editorId, isEditorMounted]);
 
+  useEffect(() => {
+    if (!editorRef.current) {
+      return;
+    }
+
+    const model = editorRef.current.getModel();
+
+    if (!model) {
+      return;
+    }
+
+    if (model?.getValue() !== props.value) {
+      model.setValue(props.value);
+      editorRef.current?.setPosition({
+        lineNumber: model.getLineCount(),
+        column: model.getLineMaxColumn(model.getLineCount()),
+      });
+    }
+  }, [props.value]);
+
   const handleEditorDidMount = (
     editor: editor.IStandaloneCodeEditor,
     monaco: typeof import("monaco-editor")
@@ -162,6 +183,7 @@ export function MonacoCelEditor(props: MonacoCelProps) {
         },
       }}
       options={{
+        readOnly: props.readOnly,
         lineNumbers: "off",
         minimap: { enabled: false },
         scrollbar: {
diff --git a/keep-ui/shared/ui/MonacoCELEditor/validation-hook.ts b/keep-ui/shared/ui/MonacoCELEditor/validation-hook.ts
index d83294e4b9..17d3c87c38 100644
--- a/keep-ui/shared/ui/MonacoCELEditor/validation-hook.ts
+++ b/keep-ui/shared/ui/MonacoCELEditor/validation-hook.ts
@@ -1,4 +1,5 @@
 import { useApi } from "@/shared/lib/hooks/useApi";
+import { useDebouncedValue } from "@/utils/hooks/useDebouncedValue";
 import { editor } from "monaco-editor";
 import { useEffect, useMemo, useState } from "react";
 import useSWR from "swr";
@@ -8,34 +9,31 @@ interface CelExpressionValidationMarker {
   columnEnd: number;
 }
 
-export function useCelValidation(cel: string): editor.IMarkerData[] {
+export function useCelValidation(
+  cel: string | undefined
+): editor.IMarkerData[] {
   const api = useApi();
   const uri = `/cel/validate`;
-  const [celToValidate, setCelToValidate] = useState<string>(cel);
-
-  // debounce the cel input to avoid too many requests
-  useEffect(() => {
-    const timeout = setTimeout(() => {
-      setCelToValidate(cel);
-    }, 500);
-    return () => {
-      clearTimeout(timeout);
-    };
-  }, [cel, setCelToValidate]);
+  const [debouncedCel] = useDebouncedValue(cel, 500);
 
   const { data, error, isLoading } = useSWR<CelExpressionValidationMarker[]>(
-    () => (api.isReady() ? uri + celToValidate : null),
+    () => (api.isReady() && debouncedCel ? uri + debouncedCel : null),
     () => {
-      if (!celToValidate) {
+      if (!debouncedCel) {
         return [];
       }
 
       return api.post(uri, { cel });
+    },
+    {
+      revalidateOnFocus: false,
+      revalidateOnReconnect: false,
+      keepPreviousData: false,
     }
   );
 
   const validationErrors: editor.IMarkerData[] = useMemo(() => {
-    if (!data) {
+    if (!data || !debouncedCel) {
       return [];
     }
 
@@ -44,11 +42,11 @@ export function useCelValidation(cel: string): editor.IMarkerData[] {
       startLineNumber: 1,
       endLineNumber: 1,
       startColumn: Math.max(marker.columnStart - 1, 0),
-      endColumn: Math.min(marker.columnEnd + 1, celToValidate.length),
+      endColumn: Math.min(marker.columnEnd + 1, debouncedCel.length),
       message: "The error is found at this position",
       source: "CEL",
     }));
-  }, [data, celToValidate]);
+  }, [data, debouncedCel]);
 
   return isLoading ? [] : validationErrors;
 }
diff --git a/keep-ui/utils/cel-ast.ts b/keep-ui/utils/cel-ast.ts
new file mode 100644
index 0000000000..8b0736c6df
--- /dev/null
+++ b/keep-ui/utils/cel-ast.ts
@@ -0,0 +1,71 @@
+export namespace CelAst {
+  export enum LogicalNodeOperator {
+    AND = "&&",
+    OR = "||",
+  }
+
+  export enum ComparisonNodeOperator {
+    LT = "<",
+    LE = "<=",
+    GT = ">",
+    GE = ">=",
+    EQ = "==",
+    NE = "!=",
+    IN = "in",
+    CONTAINS = "contains",
+    STARTS_WITH = "startsWith",
+    ENDS_WITH = "endsWith",
+  }
+
+  export enum UnaryNodeOperator {
+    NOT = "!",
+    NEG = "-",
+  }
+
+  export enum DataType {
+    STRING = "string",
+    UUID = "uuid",
+    INTEGER = "integer",
+    FLOAT = "float",
+    DATETIME = "datetime",
+    BOOLEAN = "boolean",
+    OBJECT = "object",
+    ARRAY = "array",
+    NULL = "null",
+  }
+
+  export interface Node {
+    node_type: string;
+  }
+
+  export interface ConstantNode extends Node {
+    value: any;
+  }
+
+  export interface ParenthesisNode extends Node {
+    expression: Node;
+  }
+
+  export interface LogicalNode extends Node {
+    left: Node;
+    operator: LogicalNodeOperator;
+    right: Node;
+  }
+
+  export interface ComparisonNode extends Node {
+    first_operand?: Node;
+    operator: ComparisonNodeOperator;
+    second_operand?: Node | any;
+  }
+
+  export interface UnaryNode extends Node {
+    operator: UnaryNodeOperator;
+    operand?: Node;
+  }
+
+  export interface PropertyAccessNode extends Node {
+    path: string[];
+    value?: any;
+    data_type?: DataType;
+  }
+}
diff --git a/keep-ui/utils/hooks/useRules.ts b/keep-ui/utils/hooks/useRules.ts
index 15284325ad..79aba1083b 100644
--- a/keep-ui/utils/hooks/useRules.ts
+++ b/keep-ui/utils/hooks/useRules.ts
@@ -1,5 +1,6 @@
 import useSWR, { SWRConfiguration } from "swr";
 import { useApi } from "@/shared/lib/hooks/useApi";
+import { CelAst } from "../cel-ast";
 
 export type Rule = {
   id: string;
@@ -8,6 +9,7 @@ export type Rule = {
   group_description: string | null;
   grouping_criteria: string[];
   definition_cel: string;
+  definition_cel_ast: CelAst.Node;
   definition: { sql: string; params: {} };
   timeframe: number;
   timeunit: "minutes" | "seconds" | "hours" | "days";
diff --git a/keep/api/core/alerts.py b/keep/api/core/alerts.py
index 2f9d72d562..301ec2aa30 100644
--- a/keep/api/core/alerts.py
+++ b/keep/api/core/alerts.py
@@ -3,12 +3,12 @@
 import logging
 import os
 from typing import Tuple
-from uuid import UUID
 
 from sqlalchemy import and_, func, select
 from sqlalchemy.exc import OperationalError
 from sqlmodel import Session, text
 
+from keep.api.core.cel_to_sql.ast_nodes import DataType
 from keep.api.core.cel_to_sql.properties_metadata import (
     FieldMappingConfiguration,
     PropertiesMetadata,
@@ -40,34 +40,42 @@
 
 alert_field_configurations = [
     FieldMappingConfiguration(
-        map_from_pattern="id", map_to="lastalert.alert_id", data_type=UUID
+        map_from_pattern="id", map_to="lastalert.alert_id", data_type=DataType.UUID
     ),
     FieldMappingConfiguration(
-        map_from_pattern="source", map_to="alert.provider_type", data_type=str
+        map_from_pattern="source",
+        map_to="alert.provider_type",
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
-        map_from_pattern="providerId", map_to="alert.provider_id", data_type=str
+        map_from_pattern="providerId",
+        map_to="alert.provider_id",
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
-        map_from_pattern="providerType", map_to="alert.provider_type", data_type=str
+        map_from_pattern="providerType",
+        map_to="alert.provider_type",
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
         map_from_pattern="timestamp",
         map_to="lastalert.timestamp",
-        data_type=datetime.datetime,
+        data_type=DataType.DATETIME,
     ),
     FieldMappingConfiguration(
-        map_from_pattern="fingerprint", map_to="lastalert.fingerprint", data_type=str
+        map_from_pattern="fingerprint",
+        map_to="lastalert.fingerprint",
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
-        map_from_pattern="startedAt", map_to="startedAt", data_type=datetime.datetime
+        map_from_pattern="startedAt", map_to="startedAt", data_type=DataType.DATETIME
     ),
     FieldMappingConfiguration(
         map_from_pattern="incident.id",
         map_to=[
             "incident.id",
         ],
-        data_type=UUID,
+        data_type=DataType.UUID,
     ),
     FieldMappingConfiguration(
         map_from_pattern="incident.name",
@@ -75,7 +83,7 @@
             "incident.user_generated_name",
             "incident.ai_generated_name",
         ],
-        data_type=str,
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
         map_from_pattern="severity",
@@ -90,7 +98,7 @@
                 key=lambda s: s.order,
             )
         ],
-        data_type=str,
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
         map_from_pattern="lastReceived",
@@ -98,7 +106,7 @@
             "JSON(alertenrichment.enrichments).*",
             "JSON(alert.event).*",
         ],
-        data_type=datetime.datetime,
+        data_type=DataType.DATETIME,
     ),
     FieldMappingConfiguration(
         map_from_pattern="status",
@@ -107,7 +115,7 @@
             "JSON(alert.event).*",
         ],
         enum_values=list(reversed([item.value for _, item in enumerate(AlertStatus)])),
-        data_type=str,
+        data_type=DataType.STRING,
     ),
     FieldMappingConfiguration(
         map_from_pattern="firingCounter",
@@ -115,7 +123,15 @@
             "JSON(alertenrichment.enrichments).*",
             "JSON(alert.event).*",
         ],
-        data_type=int,
+        data_type=DataType.INTEGER,
+    ),
+    FieldMappingConfiguration(
+        map_from_pattern="dismissed",
+        map_to=[
+            "JSON(alertenrichment.enrichments).*",
+            "JSON(alert.event).*",
+        ],
+        data_type=DataType.BOOLEAN,
     ),
     FieldMappingConfiguration(
         map_from_pattern="*",
@@ -123,7 +139,7 @@
             "JSON(alertenrichment.enrichments).*",
             "JSON(alert.event).*",
         ],
-        data_type=str,
+        data_type=DataType.STRING,
     ),
 ]
 
diff --git a/keep/api/core/cel_to_sql/ast_nodes.py b/keep/api/core/cel_to_sql/ast_nodes.py
index 7a777b53dd..de180d85e6 100644
--- a/keep/api/core/cel_to_sql/ast_nodes.py
+++ b/keep/api/core/cel_to_sql/ast_nodes.py
@@ -1,7 +1,13 @@
-from typing import Any, List
+import datetime
+from types import NoneType
+from typing import Any, List, Optional
 
+from enum import Enum
 
-class Node:
+from pydantic import BaseModel, Field
+
+
+class Node(BaseModel):
     """
     A base class representing a node in an abstract syntax tree (AST).
 
@@ -9,6 +15,19 @@ class Node:
     appear in an AST. It does not implement any specific functionality but
     provides a common interface for all AST nodes.
     """
+    def __init__(self, **data):
+        super().__init__(**data)
+
+    node_type: str = Field(default=None)
+
+
+    @property
+    def __str(self):
+        """
+        Returns string representation of Node. The property used for debugging
+        """
+        return str(self)
+
 
 class ConstantNode(Node):
     """
@@ -21,10 +40,18 @@ class ConstantNode(Node):
     Methods:
         __str__(): Returns the string representation of the constant value.
     """
-    def __init__(self, value: Any):
-        self.value = value
+    node_type: str = Field(default="ConstantNode", const=True)
+    value: Any = Field()
 
     def __str__(self):
+        if self.value is None:
+            return "null"
+        if isinstance(self.value, str):
+            return f"'{self.value}'"
+        if isinstance(self.value, bool):
+            return "true" if self.value else "false"
+        if isinstance(self.value, (int, float)):
+            return str(self.value)
         return self.value
 
 class ParenthesisNode(Node):
@@ -37,21 +64,25 @@ class ParenthesisNode(Node):
     Methods:
         __str__(): Returns a string representation of the parenthesis node.
     """
-    def __init__(self, expression: Any):
-        self.expression = expression
+    node_type: str = Field(default="ParenthesisNode", const=True)
+    expression: Node = Field()
 
     def __str__(self):
         return f"({self.expression})"
 
+
+class LogicalNodeOperator(Enum):
+    AND = "&&"
+    OR = "||"
+
+
 class LogicalNode(Node):
     """
     Represents a logical operation node in CEL abstract syntax tree (AST).
-    Examples: 
+    Examples:
         alert.status == 'open' && alert.severity == 'high'
         alert.status == 'open' || alert.severity == 'high'
     Attributes:
-        AND (str): The logical AND operator.
-        OR (str): The logical OR operator.
         left (Any): The left operand of the logical operation.
         operator (str): The logical operator ('&&' for AND, '||' for OR).
         right (Any): The right operand of the logical operation.
@@ -61,16 +92,27 @@ class LogicalNode(Node):
         __str__() -> str:
             Returns a string representation of the logical operation in the format "left operator right".
     """
-    AND = '&&'
-    OR = '||'
-
-    def __init__(self, left: Any, operator: str, right: Any):
-        self.left = left
-        self.operator = operator
-        self.right = right
-    
+    node_type: str = Field(default="LogicalNode", const=True)
+    left: Node = Field()
+    operator: LogicalNodeOperator = Field()
+    right: Node = Field()
+
     def __str__(self):
-        return f"{self.left} {self.operator} {self.right}"
+        return f"{self.left} {self.operator.value} {self.right }"
+
+
+class ComparisonNodeOperator(Enum):
+    LT = "<"
+    LE = "<="
+    GT = ">"
+    GE = ">="
+    EQ = "=="
+    NE = "!="
+    IN = "in"
+    CONTAINS = "contains"
+    STARTS_WITH = "startsWith"
+    ENDS_WITH = "endsWith"
+
 
 class ComparisonNode(Node):
     """
@@ -79,14 +121,6 @@ class ComparisonNode(Node):
         alert.severity == 'high'
         alert.count > 10
         alert.status != 'closed'
-    Attributes:
-        LT (str): Less than operator ('<').
-        LE (str): Less than or equal to operator ('<=').
-        GT (str): Greater than operator ('>').
-        GE (str): Greater than or equal to operator ('>=').
-        EQ (str): Equal to operator ('==').
-        NE (str): Not equal to operator ('!==').
-        IN (str): In operator ('in').
 
     Args:
         first_operand (Node): The left-hand side operand of the comparison.
@@ -96,21 +130,34 @@ class ComparisonNode(Node):
     Methods:
         __str__(): Returns a string representation of the comparison operation.
     """
-    LT = '<'
-    LE = '<='
-    GT = '>'
-    GE = '>='
-    EQ = '=='
-    NE = '!=='
-    IN = 'in'
-
-    def __init__(self, first_operand: Node, operator: str, second_operand: Node):
-        self.operator = operator
-        self.first_operand = first_operand
-        self.second_operand = second_operand
+    node_type: str = Field(default="ComparisonNode", const=True)
+    first_operand: Optional[Node] = Field()
+    operator: ComparisonNodeOperator = Field()
+    second_operand: Optional[Node | Any] = Field()
 
     def __str__(self):
-        return f"{self.first_operand} {self.operator} {self.second_operand}"
+        operand_value = None
+
+        if self.operator == ComparisonNodeOperator.IN:
+            operand_value = (
+                f"[{', '.join([str(item) for item in self.second_operand])}]"
+            )
+        elif self.operator in [
+            ComparisonNodeOperator.CONTAINS,
+            ComparisonNodeOperator.STARTS_WITH,
+            ComparisonNodeOperator.ENDS_WITH,
+        ]:
+            return f"{self.first_operand}.{self.operator.value}({self.second_operand})"
+        else:
+            operand_value = str(self.second_operand)
+
+        return f"{self.first_operand} {self.operator.value} {operand_value}"
+
+
+class UnaryNodeOperator(Enum):
+    NOT = "!"
+    NEG = "-"
+
 
 class UnaryNode(Node):
     """
@@ -119,8 +166,6 @@ class UnaryNode(Node):
         !alert.active
         -alert.threshold
     Attributes:
-        NOT (str): The logical NOT operator.
-        NEG (str): The negation operator.
         operator (str): The operator for the unary operation.
         operand (Any): The operand for the unary operation.
     Methods:
@@ -129,152 +174,106 @@ class UnaryNode(Node):
         __str__() -> str:
             Returns a string representation of the unary operation.
     """
-    NOT = '!'
-    NEG = '-'
-
-    def __init__(self, operator: str, operand: Any):
-        self.operator = operator
-        self.operand = operand
+    node_type: str = Field(default="UnaryNode", const=True)
+    operator: UnaryNodeOperator = Field()
+    operand: Optional[Node] = Field()
 
     def __str__(self):
-        return f"{self.operator}{self.operand}"
+        return f"{self.operator.value}{self.operand}"
 
-class MemberAccessNode(Node):
-    """
-    A node representing member access in CEL abstract syntax tree (AST).
-    Attributes:
-        member_name (str): The name of the member being accessed.
-    Methods:
-        __str__(): Returns the member name as a string.
-    """
-    def __init__(self, member_name: str):
-        self.member_name = member_name
-    
-    def __str__(self):
-        return self.member_name
 
-class MethodAccessNode(MemberAccessNode):
+class DataType(Enum):
     """
-    Represents a method access node in CEL abstract syntax tree (AST).
-    Examples:
-        alert.name.contains('error')
-        alert.name.startsWith('sys')
-        alert.name.endsWith('log')
-    Inherits from:
-        MemberAccessNode
+    An enumeration representing various data types.
 
     Attributes:
-        member_name (str): The name of the member being accessed.
-        args (List[str], optional): A list of arguments for the method. Defaults to None.
-
-    Methods:
-        copy() -> MethodAccessNode:
-            Creates a copy of the current MethodAccessNode instance.
-        
-        __str__() -> str:
-            Returns a string representation of the method access node in the format:
-            "member_name(arg1, arg2, ...)".
+        STRING (str): Represents a string data type.
+        UUID (str): Represents a universally unique identifier (UUID) data type.
+        INTEGER (str): Represents an integer data type.
+        FLOAT (str): Represents a floating-point number data type.
+        DATETIME (str): Represents a datetime data type.
+        BOOLEAN (str): Represents a boolean data type.
+        OBJECT (str): Represents an object data type.
+        ARRAY (str): Represents an array data type.
     """
-    def __init__(self, member_name, args: List[str] = None):
-        self.args = args
-        super().__init__(member_name)
-
-    def copy(self):
-        return MethodAccessNode(self.member_name, self.args.copy() if self.args else None)
 
-    def __str__(self):
-        args = []
-
-        for arg_node in self.args:
-            args.append(str(arg_node))
-
-        return f"{self.member_name}({', '.join(args)})"
-
-class PropertyAccessNode(MemberAccessNode):
+    STRING = "string"
+    UUID = "uuid"
+    INTEGER = "integer"
+    FLOAT = "float"
+    DATETIME = "datetime"
+    BOOLEAN = "boolean"
+    OBJECT = "object"
+    ARRAY = "array"
+    NULL = "null"
+
+
+def from_type_to_data_type(_type: type) -> DataType:
+    if _type is str:
+        return DataType.STRING
+    elif _type is int:
+        return DataType.INTEGER
+    elif _type is float:
+        return DataType.FLOAT
+    elif _type is bool:
+        return DataType.BOOLEAN
+    elif _type is NoneType:
+        return DataType.NULL
+    elif _type is dict:
+        return DataType.OBJECT
+    elif _type is list:
+        return DataType.ARRAY
+    elif _type is datetime.datetime:
+        return DataType.DATETIME
+
+    raise ValueError(
+        f"There is no DataType corresponding to the provided type: {_type}"
+    )
+
+
+class PropertyAccessNode(Node):
     """
     Represents a node in CEL abstract syntax tree (AST) that accesses a property of an object.
     Examples:
         alert.name
         alert.status
     Attributes:
-        member_name (str): The name of the member being accessed.
+        path (str): The property path being accessed.
         value (Any): The value associated with the member access, which can be another node.
     Methods:
         __init__(member_name, value: Any):
             Initializes the PropertyAccessNode with the given member name and value.
-        is_function_call() -> bool:
-            Determines if the member access represents a function call.
-        get_property_path() -> str:
-            Constructs and returns the property path as a string.
-        get_method_access_node() -> MethodAccessNode:
-            Retrieves the MethodAccessNode if the value represents a method access.
         __str__() -> str:
             Returns a string representation of the PropertyAccessNode.
     """
 
-    def __init__(self, member_name: str, value: Any, data_type: type = None):
-        self.value = value
-        self.data_type = data_type
-        super().__init__(member_name)
-
-    def is_function_call(self) -> bool:
-        member_access_node = self.get_method_access_node()
-
-        return member_access_node is not None
-
-    def get_property_path(self) -> list[str]:
-        if isinstance(self.value, PropertyAccessNode) or isinstance(
-            self.value, IndexAccessNode
-        ):
-            return [self.member_name] + (
-                self.value.get_property_path() if self.value else []
-            )
-
-        return [self.member_name]
-
-    def get_method_access_node(self) -> MethodAccessNode:
-        if isinstance(self.value, MethodAccessNode):
-            return self.value
-
-        if isinstance(self.value, PropertyAccessNode):
-            return self.value.get_method_access_node()
-
-        return None
+    node_type: str = Field(default="PropertyAccessNode", const=True)
+    path: list[str] = Field(default=None)
+    data_type: DataType = Field(default=None)
 
     def __str__(self):
-        if self.value:
-            return f"{self.member_name}.{self.value}"
+        return ".".join(self.path)
 
-        return self.member_name
 
-class IndexAccessNode(PropertyAccessNode):
+class CoalesceNode(Node):
     """
-    Represents an index access node in CEL abstract syntax tree (AST).
-    This node is used to represent access to a property or method via an index.
-    Examples:
-        alert['name']
-        alert['status']
+    Represents a Coalesce node in an abstract syntax tree (AST).
+
+    A CoalesceNode is used to represent a coalesce operation, which evaluates
+    a list of properties and returns the first non-null value.
+
     Attributes:
-        member_name (str): The name of the member being accessed.
-        value (Any): The value associated with the member, which can be another node.
+        properties (List[PropertyAccessNode]): A list of PropertyAccessNode
+            objects representing the properties to be evaluated in the coalesce
+            operation.
+
     Methods:
-        get_property_path() -> str:
-            Returns the property path as a string, including the member name and any nested method access.
-        __str__() -> str:
-            Returns a string representation of the index access node.
+        __str__(): Returns a string representation of the coalesce operation
+            in the format "coalesce(prop1, prop2, ...)".
     """
-    def __init__(self, member_name: str, value: Any):
-        super().__init__(member_name, value)
 
-    def __str__(self):
-        return f"[{self.member_name}]"
-
-    def get_property_path(self) -> list[str]:
-        if isinstance(self.value, PropertyAccessNode) or isinstance(
-            self.value, IndexAccessNode
-        ):
-            return [self.member_name] + (
-                self.value.get_property_path() if self.value else []
-            )
+    node_type: str = Field(default="CoalesceNode", const=True)
+    properties: list[PropertyAccessNode] = Field(default=None)
 
-        return [self.member_name]
+    def __str__(self):
+        return f"coalesce({', '.join([str(prop) for prop in self.properties])})"
diff --git a/keep/api/core/cel_to_sql/cel_ast_converter.py b/keep/api/core/cel_to_sql/cel_ast_converter.py
index a1ef0f6cf0..105e246066 100644
--- a/keep/api/core/cel_to_sql/cel_ast_converter.py
+++ b/keep/api/core/cel_to_sql/cel_ast_converter.py
@@ -8,14 +8,15 @@
 
 from keep.api.core.cel_to_sql.ast_nodes import (
     ComparisonNode,
+    ComparisonNodeOperator,
     ConstantNode,
-    IndexAccessNode,
     LogicalNode,
-    MethodAccessNode,
+    LogicalNodeOperator,
     Node,
     ParenthesisNode,
     PropertyAccessNode,
     UnaryNode,
+    UnaryNodeOperator,
 )
 
 # Matches such strings:
@@ -74,11 +75,9 @@ def conditionalor(self, tree: lark.Tree) -> None:
         else:
             right = self.stack.pop()
             left = self.stack.pop()
-            self.stack.append(LogicalNode(
-                left = left,
-                operator = LogicalNode.OR,
-                right = right
-            ))
+            self.stack.append(
+                LogicalNode(left=left, operator=LogicalNodeOperator.OR, right=right)
+            )
 
     def conditionaland(self, tree: lark.Tree) -> None:
         if len(tree.children) == 1:
@@ -86,11 +85,9 @@ def conditionaland(self, tree: lark.Tree) -> None:
         else:
             right = self.stack.pop()
             left = self.stack.pop()
-            self.stack.append(LogicalNode(
-                left = left,
-                operator = LogicalNode.AND,
-                right = right
-            ))
+            self.stack.append(
+                LogicalNode(left=left, operator=LogicalNodeOperator.AND, right=right)
+            )
 
     def relation(self, tree: lark.Tree) -> None:
         # self.member_access_stack.clear()
@@ -106,63 +103,63 @@ def relation(self, tree: lark.Tree) -> None:
     def relation_lt(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.LT,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.LT,
+                second_operand=None,
             )
         )
 
     def relation_le(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.LE,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.LE,
+                second_operand=None,
             )
         )
 
     def relation_gt(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.GT,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.GT,
+                second_operand=None,
             )
         )
 
     def relation_ge(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.GE,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.GE,
+                second_operand=None,
             )
         )
 
     def relation_eq(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.EQ,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.EQ,
+                second_operand=None,
             )
         )
 
     def relation_ne(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.NE,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.NE,
+                second_operand=None,
             )
         )
 
     def relation_in(self, tree: lark.Tree) -> None:
         self.stack.append(
             ComparisonNode(
-                first_operand = self.stack.pop(),
-                operator = ComparisonNode.IN,
-                second_operand=None
+                first_operand=self.stack.pop(),
+                operator=ComparisonNodeOperator.IN,
+                second_operand=None,
             )
         )
 
@@ -229,23 +226,22 @@ def unary(self, tree: lark.Tree) -> None:
             self.stack.append(unaryNode)
 
     def unary_not(self, tree: lark.Tree) -> None:
-        self.stack.append(
-            UnaryNode(operator=UnaryNode.NOT, operand=None)
-        )
+        self.stack.append(UnaryNode(operator=UnaryNodeOperator.NOT, operand=None))
 
     def unary_neg(self, tree: lark.Tree) -> None:
-        self.stack.append(
-            UnaryNode(operator=UnaryNode.NEG, operand=None)
-        )
+        self.stack.append(UnaryNode(operator=UnaryNodeOperator.NEG, operand=None))
 
     def member_dot(self, tree: lark.Tree) -> None:
         right = cast(lark.Token, tree.children[1]).value
 
         if self.member_access_stack:
             property_member: PropertyAccessNode = self.member_access_stack.pop()
-            property_value = PropertyAccessNode(member_name=right, value=None)
-            property_member.value = property_value
-            self.member_access_stack.append(property_value)
+            new_property_access_node = PropertyAccessNode(
+                path=property_member.path + [right]
+            )
+            self.stack.pop()
+            self.stack.append(new_property_access_node)
+            self.member_access_stack.append(new_property_access_node)
 
     def member_dot_arg(self, tree: lark.Tree) -> None:
         if len(tree.children) == 3:
@@ -254,12 +250,21 @@ def member_dot_arg(self, tree: lark.Tree) -> None:
             exprlist = []
         right = cast(lark.Token, tree.children[1]).value
         if self.member_access_stack:
-            left: PropertyAccessNode = self.member_access_stack.pop()
-
-            method = MethodAccessNode(member_name=right, args=[item for item in reversed(exprlist)])
-            left.value = method
-
-            self.member_access_stack.append(method)
+            if right.lower() in [
+                ComparisonNodeOperator.CONTAINS.value.lower(),
+                ComparisonNodeOperator.STARTS_WITH.value.lower(),
+                ComparisonNodeOperator.ENDS_WITH.value.lower(),
+            ]:
+                self.stack.append(
+                    ComparisonNode(
+                        first_operand=self.stack.pop(),
+                        operator=right,
+                        second_operand=exprlist[0],
+                    )
+                )
+                return
+
+            raise NotImplementedError(f"Method '{right}' not implemented")
         else:
             raise ValueError("No member access stack")
 
@@ -270,15 +275,11 @@ def member_index(self, tree: lark.Tree) -> None:
         if isinstance(right, ConstantNode):
             right = right.value
 
-        prop_access_node = left
-
-        while prop_access_node.value is not None:
-            prop_access_node = prop_access_node.value
-
-        prop_access_node.value = IndexAccessNode(str(right), None)
-
+        prop_access_node: PropertyAccessNode = left
         self.stack.append(left)
-        self.member_access_stack.append(prop_access_node.value)
+        self.member_access_stack.append(
+            PropertyAccessNode(path=prop_access_node.path + [str(right)])
+        )
 
     def member_object(self, tree: lark.Tree) -> None:
         raise NotImplementedError("Member object not implemented")
@@ -293,7 +294,9 @@ def ident_arg(self, tree: lark.Tree) -> None:
         raise NotImplementedError("Ident arg not implemented")
 
     def ident(self, tree: lark.Tree) -> None:
-        property_member = PropertyAccessNode(member_name=cast(lark.Token, tree.children[0]).value, value=None)
+        property_member = PropertyAccessNode(
+            path=[cast(lark.Token, tree.children[0]).value]
+        )
         self.member_access_stack.clear()
         self.stack.append(property_member)
         self.member_access_stack.append(property_member)
diff --git a/keep/api/core/cel_to_sql/cel_ast_rebuilder.py b/keep/api/core/cel_to_sql/cel_ast_rebuilder.py
new file mode 100644
index 0000000000..8fab046654
--- /dev/null
+++ b/keep/api/core/cel_to_sql/cel_ast_rebuilder.py
@@ -0,0 +1,222 @@
+from keep.api.core.cel_to_sql.ast_nodes import (
+    CoalesceNode,
+    ComparisonNodeOperator,
+    ConstantNode,
+    LogicalNodeOperator,
+    Node,
+    LogicalNode,
+    ComparisonNode,
+    PropertyAccessNode,
+    UnaryNode,
+    ParenthesisNode,
+    UnaryNodeOperator,
+)
+
+from keep.api.core.cel_to_sql.properties_mapper import (
+    MultipleFieldsNode,
+)
+
+
+class CelAstRebuilder:
+    def __init__(self, cel_ast: Node):
+        self.cel_ast = cel_ast
+        super().__init__()
+
+    def rebuild(self) -> Node:
+        self.stack = []
+        result = self.__visit_ast(self.cel_ast)
+        self.stack = []
+        return result
+
+    def __visit_ast(self, abstract_node: Node) -> Node:
+        result = None
+
+        if abstract_node is None:
+            return None
+
+        if isinstance(abstract_node, ParenthesisNode):
+            result = ParenthesisNode(
+                expression=self.__visit_ast(abstract_node.left),
+            )
+
+        if isinstance(abstract_node, LogicalNode):
+            result = LogicalNode(
+                left=self._process_logical_node_side(abstract_node.left, True),
+                operator=abstract_node.operator,
+                right=self._process_logical_node_side(abstract_node.right, True),
+            )
+
+        if isinstance(abstract_node, ComparisonNode):
+            result = self._visit_comparison_node(abstract_node)
+
+        if isinstance(abstract_node, PropertyAccessNode):
+            result = abstract_node
+
+        if isinstance(abstract_node, UnaryNode):
+            if abstract_node.operator == UnaryNodeOperator.NOT:
+                result = self._visit_unary_not_node(abstract_node)
+            else:
+                result = UnaryNode(
+                    operator=abstract_node.operator,
+                    operand=self.__visit_ast(abstract_node.operand),
+                )
+
+        if isinstance(abstract_node, ConstantNode):
+            result = abstract_node
+
+        if isinstance(abstract_node, MultipleFieldsNode):
+            result = abstract_node
+
+        if result:
+            return result
+
+        raise NotImplementedError(
+            f"{type(abstract_node).__name__} node type is not supported yet"
+        )
+
+    def _process_logical_node_side(self, side: Node, value: bool) -> Node:
+        if isinstance(side, MultipleFieldsNode):
+            return ComparisonNode(
+                first_operand=CoalesceNode(
+                    properties=side.fields,
+                ),
+                operator=ComparisonNodeOperator.EQ,
+                second_operand=ConstantNode(value=value),
+            )
+        elif isinstance(side, PropertyAccessNode):
+            return ComparisonNode(
+                first_operand=side,
+                operator=ComparisonNodeOperator.EQ,
+                second_operand=ConstantNode(value=value),
+            )
+
+        return self.__visit_ast(side)
+
+    def _visit_parentheses(self, node: str) -> Node:
+        return f"({node})"
+
+    def _visit_unary_not_node(self, unary_node: UnaryNode) -> Node:
+        current_node: Node = unary_node
+        depth = 0
+
+        while isinstance(current_node, UnaryNode):
+            current_node = current_node.operand
+            depth += 1
+
+        if isinstance(current_node, PropertyAccessNode) or isinstance(
+            current_node, MultipleFieldsNode
+        ):
+            if depth % 2 != 0:
+                return self._process_logical_node_side(current_node, False)
+
+            return self._process_logical_node_side(current_node, True)
+
+        if depth % 2 != 0:
+            return UnaryNode(operator=UnaryNodeOperator.NOT, operand=current_node)
+
+        return current_node
+
+    def _handle_mutliple_fields_node(
+        self,
+        fields: list[PropertyAccessNode],
+        callback: lambda field_node, is_first, is_last: Node,
+    ) -> Node:
+        final_node = None
+        current_node = None
+        for index, field in enumerate(fields):
+            current_node = callback(field, index == 0, index == len(fields) - 1)
+            if final_node is None:
+                final_node = current_node
+            else:
+                final_node = LogicalNode(
+                    left=final_node,
+                    operator=LogicalNodeOperator.OR,
+                    right=current_node,
+                )
+
+        return ParenthesisNode(expression=final_node)
+
+    # region Comparison Visitors
+    def _visit_comparison_node(self, comparison_node: ComparisonNode) -> Node:
+
+        if comparison_node.operator == ComparisonNodeOperator.IN:
+            return self._visit_in(comparison_node)
+
+        if isinstance(comparison_node.first_operand, MultipleFieldsNode):
+            fields = comparison_node.first_operand.fields
+
+            # in case it's comparison with null, no reason to check all fields
+            # if it's null, we can just check the last field in the list
+            if (
+                isinstance(comparison_node.second_operand, ConstantNode)
+                and comparison_node.operator == ComparisonNodeOperator.EQ
+                and comparison_node.second_operand.value is None
+            ):
+                fields = fields[-1:]
+
+            return self._handle_mutliple_fields_node(
+                fields,
+                lambda field_node, is_first, is_last: self._visit_comparison_node(
+                    ComparisonNode(
+                        first_operand=field_node,
+                        operator=comparison_node.operator,
+                        second_operand=comparison_node.second_operand,
+                    )
+                ),
+            )
+
+        return comparison_node
+
+    def _visit_in(self, in_node: ComparisonNode, skip_null_check=False) -> Node:
+        if isinstance(in_node.first_operand, MultipleFieldsNode):
+            return self._handle_mutliple_fields_node(
+                in_node.first_operand.fields,
+                lambda field_node, is_first, is_last: self._visit_in(
+                    in_node=ComparisonNode(
+                        first_operand=field_node,
+                        operator=in_node.operator,
+                        second_operand=in_node.second_operand,
+                    ),
+                    skip_null_check=not is_last,
+                ),
+            )
+        is_none_in_args = None in in_node.second_operand
+        filtered_args = []
+        nodes = []
+
+        for item in in_node.second_operand:
+            is_none_in_args = item.value is None
+
+            if item.value is not None:
+                filtered_args.append(item)
+
+        nodes = []
+
+        if len(filtered_args) > 0:
+            nodes.append(
+                ComparisonNode(
+                    operator=ComparisonNodeOperator.IN,
+                    first_operand=in_node.first_operand,
+                    second_operand=filtered_args,
+                )
+            )
+
+        if is_none_in_args and not skip_null_check:
+            nodes.append(
+                ComparisonNode(
+                    operator=ComparisonNodeOperator.EQ,
+                    first_operand=in_node.first_operand,
+                    second_operand=ConstantNode(value=None),
+                )
+            )
+
+        final_node = nodes[0]
+
+        for query in nodes[1:]:
+            final_node = LogicalNode(
+                left=final_node,
+                operator=LogicalNodeOperator.OR,
+                right=query,
+            )
+
+        return ParenthesisNode(expression=final_node)
diff --git a/keep/api/core/cel_to_sql/properties_mapper.py b/keep/api/core/cel_to_sql/properties_mapper.py
index 08038690ec..60b9758a47 100644
--- a/keep/api/core/cel_to_sql/properties_mapper.py
+++ b/keep/api/core/cel_to_sql/properties_mapper.py
@@ -1,13 +1,15 @@
+from typing import Optional
 from keep.api.core.cel_to_sql.ast_nodes import (
     ComparisonNode,
+    ComparisonNodeOperator,
     ConstantNode,
+    DataType,
     LogicalNode,
-    MemberAccessNode,
-    MethodAccessNode,
     Node,
     ParenthesisNode,
     PropertyAccessNode,
     UnaryNode,
+    UnaryNodeOperator,
 )
 
 from keep.api.core.cel_to_sql.properties_metadata import (
@@ -27,20 +29,28 @@ class JsonPropertyAccessNode(PropertyAccessNode):
     Attributes:
         json_property_name (str): The name of the JSON property to access.
         property_to_extract (str): The specific property to extract from the JSON object.
-        method_access_node (MethodAccessNode): The method access node used for extraction. (*.contains, *.startsWith, etc)
     """
     def __init__(
         self,
         json_property_name: str,
         property_to_extract: list[str],
-        method_access_node: MethodAccessNode,
-        data_type: type,
+        data_type: DataType,
     ):
-        super().__init__(f"JSON({json_property_name}).{property_to_extract}", method_access_node)
+        super().__init__(
+            member_name=f"JSON({json_property_name}).{property_to_extract}",
+        )
+        self.path = [json_property_name] + property_to_extract
         self.json_property_name = json_property_name
         self.property_to_extract = property_to_extract
         self.data_type = data_type
 
+    json_property_name: Optional[str]
+    property_to_extract: Optional[list[str]]
+    data_type: Optional[DataType]
+
+    def __str__(self):
+        return f"JSON({self.json_property_name})." + ".".join(self.property_to_extract)
+
 
 class MultipleFieldsNode(Node):
     """
@@ -53,9 +63,11 @@ class MultipleFieldsNode(Node):
     Args:
         fields (list[PropertyAccessNode]): A list of PropertyAccessNode instances to initialize the node with.
     """
-    def __init__(self, fields: list[PropertyAccessNode], data_type: type = None):
-        self.fields = fields
-        self.data_type = data_type
+    fields: list[PropertyAccessNode]
+    data_type: Optional[DataType]
+
+    def __str__(self):
+        return f"[{', '.join(['.'.join(field.path) for field in self.fields])}]"
 
 
 class PropertiesMappingException(Exception):
@@ -81,11 +93,11 @@ class PropertiesMapper:
             Recursively visits and processes nodes in the AST, mapping properties as needed.
         __visit_comparison_node(comparison_node: ComparisonNode, involved_fields: list[PropertyMetadataInfo]) -> Node:
             Visits and processes a comparison node, mapping properties as needed.
-        _visit_member_access_node(member_access_node: MemberAccessNode, involved_fields: list[PropertyMetadataInfo]) -> Node:
+        _visit_property_access_node(property_access_node: PropertyAccessNode, involved_fields: list[PropertyMetadataInfo]) -> Node:
             Visits and processes a member access node, mapping properties as needed.
         _modify_comparison_node_based_on_mapping(comparison_node: ComparisonNode, mapping: PropertyMetadataInfo) -> Node:
             Modifies a comparison node based on the provided property metadata mapping.
-        _create_property_access_node(mapping, method_access_node: MethodAccessNode) -> Node:
+        _create_property_access_node(mapping) -> Node:
             Creates a property access node based on the given mapping and method access node.
         _map_property(property_access_node: PropertyAccessNode) -> tuple[MultipleFieldsNode, PropertyMetadataInfo]:
             Maps a property access node to its corresponding database fields based on the metadata.
@@ -129,18 +141,20 @@ def __visit_nodes(
         if isinstance(abstract_node, ComparisonNode):
             return self.__visit_comparison_node(abstract_node, involved_fields)
 
-        if isinstance(abstract_node, MemberAccessNode):
-            return self._visit_member_access_node(abstract_node, involved_fields)
+        if isinstance(abstract_node, PropertyAccessNode):
+            return self._visit_property_access_node(abstract_node, involved_fields)
 
         if isinstance(abstract_node, UnaryNode):
             operand = self.__visit_nodes(abstract_node.operand, involved_fields)
 
             if operand is None:
-                return UnaryNode(abstract_node.operator, ConstantNode(True))
+                return UnaryNode(
+                    operator=abstract_node.operator, operand=ConstantNode(value=True)
+                )
 
             return UnaryNode(
-                abstract_node.operator,
-                self.__visit_nodes(abstract_node.operand, involved_fields),
+                operator=abstract_node.operator,
+                operand=self.__visit_nodes(abstract_node.operand, involved_fields),
             )
 
         if isinstance(abstract_node, ConstantNode):
@@ -163,92 +177,25 @@ def __visit_comparison_node(
         )
         involved_fields.append(property_metadata)
         comparison_node = ComparisonNode(
-            first_operand,
-            comparison_node.operator,
-            comparison_node.second_operand,
+            first_operand=first_operand,
+            operator=comparison_node.operator,
+            second_operand=comparison_node.second_operand,
         )
         return self._modify_comparison_node_based_on_mapping(
             comparison_node, property_metadata
         )
 
-    def _visit_member_access_node(
+    def _visit_property_access_node(
         self,
-        member_access_node: MemberAccessNode,
+        property_access_node: PropertyAccessNode,
         involved_fields: list[PropertyMetadataInfo],
     ) -> Node:
-        if (
-            isinstance(member_access_node, PropertyAccessNode)
-            and not member_access_node.is_function_call()
-        ):
-            # in case expression is just property access node
-            # it will behave like !!property in JS
-            # converting queried property to boolean and evaluate as boolean
-            mapped_prop, property_metadata = self._map_property(member_access_node)
-            involved_fields.append(property_metadata)
-            return LogicalNode(
-                left=ComparisonNode(
-                    mapped_prop,
-                    ComparisonNode.NE,
-                    ConstantNode(None),
-                ),
-                operator=LogicalNode.AND,
-                right=LogicalNode(
-                    left=ComparisonNode(
-                        mapped_prop,
-                        ComparisonNode.NE,
-                        ConstantNode("0"),
-                    ),
-                    operator=LogicalNode.AND,
-                    right=LogicalNode(
-                        left=ComparisonNode(
-                            mapped_prop,
-                            ComparisonNode.NE,
-                            ConstantNode(False),
-                        ),
-                        operator=LogicalNode.AND,
-                        right=ComparisonNode(
-                            mapped_prop,
-                            ComparisonNode.NE,
-                            ConstantNode(""),
-                        ),
-                    ),
-                ),
-            )
-
-        if (
-            isinstance(member_access_node, PropertyAccessNode)
-            and member_access_node.is_function_call()
-        ):
-            property_metadata = self.properties_metadata.get_property_metadata(
-                member_access_node.get_property_path()
-            )
-
-            if not property_metadata:
-                raise PropertiesMappingException(
-                    f'Missing mapping configuration for property "{member_access_node.get_property_path()}" '
-                    f'while processing the comparison node: "{member_access_node}".'
-                )
-            involved_fields.append(property_metadata)
-            result = None
-            for mapping in property_metadata.field_mappings:
-                method_access_node = member_access_node.get_method_access_node().copy()
-                current_node_result = self._create_property_access_node(
-                    mapping, property_metadata.data_type, method_access_node
-                )
-
-                if result is None:
-                    result = current_node_result
-                    continue
-
-                result = LogicalNode(
-                    left=result,
-                    operator=LogicalNode.OR,
-                    right=current_node_result,
-                )
-
-            return result
-
-        return member_access_node
+        # in case expression is just property access node
+        # it will behave like !!property in JS
+        # converting queried property to boolean and evaluate as boolean
+        mapped_prop, property_metadata = self._map_property(property_access_node)
+        involved_fields.append(property_metadata)
+        return mapped_prop
 
     def _modify_comparison_node_based_on_mapping(
         self, comparison_node: ComparisonNode, mapping: PropertyMetadataInfo
@@ -274,45 +221,53 @@ def _modify_comparison_node_based_on_mapping(
             ComparisonNode: The modified comparison node, or the original comparison
             node if no modifications are necessary.
         """
+        if not isinstance(comparison_node.second_operand, ConstantNode):
+            return comparison_node
+
         if mapping.enum_values:
             if comparison_node.operator in [
-                ComparisonNode.GE,
-                ComparisonNode.GT,
-                ComparisonNode.LE,
-                ComparisonNode.LT,
+                ComparisonNodeOperator.GE,
+                ComparisonNodeOperator.GT,
+                ComparisonNodeOperator.LE,
+                ComparisonNodeOperator.LT,
             ]:
                 if comparison_node.second_operand.value not in mapping.enum_values:
                     if comparison_node.operator in [
-                        ComparisonNode.LT,
-                        ComparisonNode.LE,
+                        ComparisonNodeOperator.LT,
+                        ComparisonNodeOperator.LE,
                     ]:
                         return UnaryNode(
-                            UnaryNode.NOT,
-                            ComparisonNode(
-                                comparison_node.first_operand,
-                                ComparisonNode.IN,
-                                [ConstantNode(item) for item in mapping.enum_values],
+                            operator=UnaryNodeOperator.NOT,
+                            operand=ComparisonNode(
+                                first_operand=comparison_node.first_operand,
+                                operator=ComparisonNodeOperator.IN,
+                                second_operand=[
+                                    ConstantNode(value=item)
+                                    for item in mapping.enum_values
+                                ],
                             ),
                         )
                     else:
                         return ComparisonNode(
-                            comparison_node.first_operand,
-                            ComparisonNode.IN,
-                            [ConstantNode(item) for item in mapping.enum_values],
+                            first_operand=comparison_node.first_operand,
+                            operator=ComparisonNodeOperator.IN,
+                            second_operand=[
+                                ConstantNode(value=item) for item in mapping.enum_values
+                            ],
                         )
 
                 index = mapping.enum_values.index(comparison_node.second_operand.value)
                 ranges = {
-                    ComparisonNode.GT: [index + 1, None],
-                    ComparisonNode.GE: [index, None],
-                    ComparisonNode.LT: [index, None],
-                    ComparisonNode.LE: [index + 1, None],
+                    ComparisonNodeOperator.GT: [index + 1, None],
+                    ComparisonNodeOperator.GE: [index, None],
+                    ComparisonNodeOperator.LT: [index, None],
+                    ComparisonNodeOperator.LE: [index + 1, None],
                 }
 
                 start_index, end_index = ranges[comparison_node.operator]
 
                 if (
-                    comparison_node.operator == ComparisonNode.LE
+                    comparison_node.operator == ComparisonNodeOperator.LE
                     and start_index >= len(mapping.enum_values)
                 ):
                     # it handles the case when queried value is the last in enum
@@ -321,43 +276,42 @@ def _modify_comparison_node_based_on_mapping(
                     return None
 
                 if (
-                    comparison_node.operator == ComparisonNode.GT
+                    comparison_node.operator == ComparisonNodeOperator.GT
                     and start_index >= len(mapping.enum_values)
                 ):
                     # nothig could be greater than the last value in enum
                     # so it will always return False
-                    return ConstantNode(False)
+                    return ConstantNode(value=False)
 
                 result = ComparisonNode(
-                    comparison_node.first_operand,
-                    ComparisonNode.IN,
-                    [
-                        ConstantNode(item)
+                    first_operand=comparison_node.first_operand,
+                    operator=ComparisonNodeOperator.IN,
+                    second_operand=[
+                        ConstantNode(value=item)
                         for item in mapping.enum_values[start_index:end_index]
                     ],
                 )
 
-                if comparison_node.operator in [ComparisonNode.LT, ComparisonNode.LE]:
-                    result = UnaryNode(UnaryNode.NOT, result)
+                if comparison_node.operator in [
+                    ComparisonNodeOperator.LT,
+                    ComparisonNodeOperator.LE,
+                ]:
+                    result = UnaryNode(operator=UnaryNodeOperator.NOT, operand=result)
                 return result
 
         return comparison_node
 
-    def _create_property_access_node(
-        self, mapping, data_type: type, method_access_node: MethodAccessNode
-    ) -> Node:
+    def _create_property_access_node(self, mapping, data_type: type) -> Node:
         if isinstance(mapping, JsonFieldMapping):
             return JsonPropertyAccessNode(
                 json_property_name=mapping.json_prop,
                 property_to_extract=mapping.prop_in_json,
-                method_access_node=method_access_node,
                 data_type=data_type,
             )
 
         if isinstance(mapping, SimpleFieldMapping):
             return PropertyAccessNode(
-                member_name=mapping.map_to,
-                value=method_access_node,
+                path=[mapping.map_to],
                 data_type=data_type,
             )
 
@@ -367,23 +321,27 @@ def _map_property(
         self, property_access_node: PropertyAccessNode
     ) -> tuple[MultipleFieldsNode, PropertyMetadataInfo]:
         property_metadata = self.properties_metadata.get_property_metadata(
-            property_access_node.get_property_path()
+            property_access_node.path
         )
 
         if not property_metadata:
+            joined_path = ".".join(property_access_node.path)
             raise PropertiesMappingException(
-                f'Missing mapping configuration for property "{property_access_node.get_property_path()}"'
+                f'Missing mapping configuration for property "{joined_path}"'
             )
 
         result = []
 
         for mapping in property_metadata.field_mappings:
             property_access_node = self._create_property_access_node(
-                mapping, property_metadata.data_type, None
+                mapping, property_metadata.data_type
             )
             result.append(property_access_node)
-        return (
-            MultipleFieldsNode(result, property_metadata.data_type)
-            if len(result) > 1
-            else result[0]
-        ), property_metadata
+        try:
+            return (
+                MultipleFieldsNode(fields=result, data_type=property_metadata.data_type)
+                if len(result) > 1
+                else result[0]
+            ), property_metadata
+        except Exception as e:
+            raise e
diff --git a/keep/api/core/cel_to_sql/properties_metadata.py b/keep/api/core/cel_to_sql/properties_metadata.py
index 14f7522967..b7b9dd0966 100644
--- a/keep/api/core/cel_to_sql/properties_metadata.py
+++ b/keep/api/core/cel_to_sql/properties_metadata.py
@@ -1,6 +1,8 @@
 import fnmatch
 import re
 
+from keep.api.core.cel_to_sql.ast_nodes import DataType
+
 
 class SimpleFieldMapping:
     def __init__(self, map_to: str):
@@ -21,7 +23,7 @@ def __init__(
         field_name: str,
         field_mappings: list[SimpleFieldMapping | JsonFieldMapping],
         enum_values: list[str],
-        data_type: type = None,
+        data_type: DataType = None,
     ):
         self.field_name = field_name
         self.field_mappings = field_mappings
@@ -35,7 +37,7 @@ def __init__(
         self,
         map_from_pattern: str,
         map_to: list[str] | str,
-        data_type: type = None,
+        data_type: DataType = None,
         enum_values: list[str] = None,
     ):
         self.map_from_pattern = map_from_pattern
diff --git a/keep/api/core/cel_to_sql/sql_providers/base.py b/keep/api/core/cel_to_sql/sql_providers/base.py
index 88c6cf7e7a..5edc3bd49c 100644
--- a/keep/api/core/cel_to_sql/sql_providers/base.py
+++ b/keep/api/core/cel_to_sql/sql_providers/base.py
@@ -3,15 +3,19 @@
 from sqlalchemy import Dialect, String
 
 from keep.api.core.cel_to_sql.ast_nodes import (
+    CoalesceNode,
+    ComparisonNodeOperator,
     ConstantNode,
-    MemberAccessNode,
+    DataType,
+    LogicalNodeOperator,
     Node,
     LogicalNode,
     ComparisonNode,
     UnaryNode,
     PropertyAccessNode,
-    MethodAccessNode,
     ParenthesisNode,
+    UnaryNodeOperator,
+    from_type_to_data_type,
 )
 from keep.api.core.cel_to_sql.cel_ast_converter import CelToAstConverter
 
@@ -23,7 +27,7 @@
     SimpleFieldMapping,
 )
 from celpy import CELParseError
-
+from keep.api.core.cel_to_sql.cel_ast_rebuilder import CelAstRebuilder
 
 class CelToSqlException(Exception):
     pass
@@ -74,14 +78,12 @@ class BaseCelToSqlProvider:
             Converts a constant value to an SQL string.
         _visit_multiple_fields_node(multiple_fields_node: MultipleFieldsNode) -> str:
             Visits a multiple fields node and converts it to an SQL string.
-        _visit_member_access_node(member_access_node: MemberAccessNode) -> str:
-            Visits a member access node and converts it to an SQL string.
         _visit_property_access_node(property_access_node: PropertyAccessNode) -> str:
+            Visits a member access node and converts it to an SQL string.
+        _visit_property_access_node(sproperty_access_node: PropertyAccessNode) -> str:
             Visits a property access node and converts it to an SQL string.
         _visit_index_property(property_path: str) -> str:
             Abstract method to handle index properties. Must be implemented in the child class.
-        _visit_method_calling(property_path: str, method_name: str, method_args: List[str]) -> str:
-            Visits a method calling node and converts it to an SQL string.
         _visit_contains_method_calling(property_path: str, method_args: List[str]) -> str:
             Abstract method to handle 'contains' method calls. Must be implemented in the child class.
         _visit_startwith_method_calling(property_path: str, method_args: List[str]) -> str:
@@ -92,7 +94,7 @@ class BaseCelToSqlProvider:
             Visits a unary node and converts it to an SQL string.
         _visit_unary_not(operand: str) -> str:
             Converts a NOT operation to an SQL string.
-        """
+    """
 
     def __init__(self, dialect: Dialect, properties_metadata: PropertiesMetadata):
         super().__init__()
@@ -126,6 +128,7 @@ def convert_to_sql_str_v2(self, cel: str) -> CelToSqlResult:
             with_mapped_props, involved_fields = (
                 self.properties_mapper.map_props_in_ast(original_query)
             )
+            with_mapped_props = CelAstRebuilder(with_mapped_props).rebuild()
         except PropertiesMappingException as e:
             raise CelToSqlException(f"Error while mapping columns: {str(e)}") from e
 
@@ -199,8 +202,8 @@ def __build_sql_filter(self, abstract_node: Node, stack: list[Node]) -> str:
         if isinstance(abstract_node, ComparisonNode):
             result = self._visit_comparison_node(abstract_node, stack)
 
-        if isinstance(abstract_node, MemberAccessNode):
-            result = self._visit_member_access_node(abstract_node, stack)
+        if isinstance(abstract_node, PropertyAccessNode):
+            result = self._visit_property_access_node(abstract_node, stack)
 
         if isinstance(abstract_node, UnaryNode):
             result = self._visit_unary_node(abstract_node, stack)
@@ -211,6 +214,14 @@ def __build_sql_filter(self, abstract_node: Node, stack: list[Node]) -> str:
         if isinstance(abstract_node, MultipleFieldsNode):
             result = self._visit_multiple_fields_node(abstract_node, None, stack)
 
+        if isinstance(abstract_node, CoalesceNode):
+            result = self.coalesce(
+                [
+                    self.__build_sql_filter(coalesce_arg, stack)
+                    for coalesce_arg in abstract_node.properties
+                ]
+            )
+
         if result:
             stack.pop()
             return result
@@ -228,7 +239,7 @@ def coalesce(self, args):
 
         return f"COALESCE({', '.join(args)})"
 
-    def cast(self, expression_to_cast: str, to_type: type, force=False) -> str:
+    def cast(self, expression_to_cast: str, to_type: DataType, force=False) -> str:
         raise NotImplementedError("CAST is not implemented. Must be implemented in the child class.")
 
     def _visit_parentheses(self, node: str) -> str:
@@ -239,9 +250,9 @@ def _visit_logical_node(self, logical_node: LogicalNode, stack: list[Node]) -> s
         left = self.__build_sql_filter(logical_node.left, stack)
         right = self.__build_sql_filter(logical_node.right, stack)
 
-        if logical_node.operator == LogicalNode.AND:
+        if logical_node.operator == LogicalNodeOperator.AND:
             return self._visit_logical_and(left, right)
-        elif logical_node.operator == LogicalNode.OR:
+        elif logical_node.operator == LogicalNodeOperator.OR:
             return self._visit_logical_or(left, right)
 
         raise NotImplementedError(
@@ -260,8 +271,13 @@ def _visit_logical_or(self, left: str, right: str) -> str:
     def _visit_comparison_node(self, comparison_node: ComparisonNode, stack: list[Node]) -> str:
         first_operand = None
         second_operand = None
+        should_cast = comparison_node.operator not in [
+            ComparisonNodeOperator.CONTAINS,
+            ComparisonNodeOperator.STARTS_WITH,
+            ComparisonNodeOperator.ENDS_WITH,
+        ]
 
-        if comparison_node.operator == ComparisonNode.IN:
+        if comparison_node.operator == ComparisonNodeOperator.IN:
             return self._visit_in(
                 comparison_node.first_operand,
                 (
@@ -279,10 +295,35 @@ def _visit_comparison_node(self, comparison_node: ComparisonNode, stack: list[No
             )
 
             if isinstance(comparison_node.first_operand, JsonPropertyAccessNode):
-                first_operand = self.cast(self.__build_sql_filter(comparison_node.first_operand, stack), type(comparison_node.second_operand.value))
+                first_operand = self.__build_sql_filter(
+                    comparison_node.first_operand, stack
+                )
+                if should_cast:
+                    first_operand = self.cast(
+                        first_operand,
+                        from_type_to_data_type(
+                            type(comparison_node.second_operand.value)
+                        ),
+                    )
+
+            if isinstance(comparison_node.first_operand, CoalesceNode):
+                first_operand = self.cast(
+                    self.__build_sql_filter(comparison_node.first_operand, stack),
+                    from_type_to_data_type(type(comparison_node.second_operand.value)),
+                )
 
             if isinstance(comparison_node.first_operand, MultipleFieldsNode):
-                first_operand = self._visit_multiple_fields_node(comparison_node.first_operand, type(comparison_node.second_operand.value), stack)
+                first_operand = self._visit_multiple_fields_node(
+                    comparison_node.first_operand,
+                    (
+                        from_type_to_data_type(
+                            type(comparison_node.second_operand.value)
+                        )
+                        if should_cast
+                        else None
+                    ),
+                    stack,
+                )
 
         if first_operand is None:
             first_operand = self.__build_sql_filter(comparison_node.first_operand, stack)
@@ -290,18 +331,30 @@ def _visit_comparison_node(self, comparison_node: ComparisonNode, stack: list[No
         if second_operand is None:
             second_operand = self.__build_sql_filter(comparison_node.second_operand, stack)
 
-        if comparison_node.operator == ComparisonNode.EQ:
+        if comparison_node.operator == ComparisonNodeOperator.EQ:
             result = self._visit_equal(first_operand, second_operand)
-        elif comparison_node.operator == ComparisonNode.NE:
+        elif comparison_node.operator == ComparisonNodeOperator.NE:
             result = self._visit_not_equal(first_operand, second_operand)
-        elif comparison_node.operator == ComparisonNode.GT:
+        elif comparison_node.operator == ComparisonNodeOperator.GT:
             result = self._visit_greater_than(first_operand, second_operand)
-        elif comparison_node.operator == ComparisonNode.GE:
+        elif comparison_node.operator == ComparisonNodeOperator.GE:
             result = self._visit_greater_than_or_equal(first_operand, second_operand)
-        elif comparison_node.operator == ComparisonNode.LT:
+        elif comparison_node.operator == ComparisonNodeOperator.LT:
             result = self._visit_less_than(first_operand, second_operand)
-        elif comparison_node.operator == ComparisonNode.LE:
+        elif comparison_node.operator == ComparisonNodeOperator.LE:
             result = self._visit_less_than_or_equal(first_operand, second_operand)
+        elif comparison_node.operator == ComparisonNodeOperator.CONTAINS:
+            result = self._visit_contains_method_calling(
+                first_operand, [comparison_node.second_operand]
+            )
+        elif comparison_node.operator == ComparisonNodeOperator.STARTS_WITH:
+            result = self._visit_starts_with_method_calling(
+                first_operand, [comparison_node.second_operand]
+            )
+        elif comparison_node.operator == ComparisonNodeOperator.ENDS_WITH:
+            result = self._visit_ends_with_method_calling(
+                first_operand, [comparison_node.second_operand]
+            )
         else:
             raise NotImplementedError(
                 f"{comparison_node.operator} comparison operator is not supported yet"
@@ -334,10 +387,11 @@ def _visit_less_than_or_equal(self, first_operand: str, second_operand: str) ->
         return f"{first_operand} <= {second_operand}"
 
     def _visit_in(self, first_operand: Node, array: list[ConstantNode], stack: list[Node]) -> str:
-        cast_to = type(array[0].value)
+        constant_value_type = type(array[0].value)
+        cast_to = from_type_to_data_type(type(array[0].value))
 
-        if not all(isinstance(item.value, cast_to) for item in array):
-            cast_to = str
+        if not all(isinstance(item.value, constant_value_type) for item in array):
+            cast_to = DataType.STRING
 
         if isinstance(first_operand, PropertyAccessNode):
             first_operand_str = self.cast(self._visit_property_access_node(first_operand, stack), cast_to)
@@ -346,39 +400,55 @@ def _visit_in(self, first_operand: Node, array: list[ConstantNode], stack: list[
         else:
             first_operand_str = self.__build_sql_filter(first_operand, stack)
 
-        constant_nodes_without_none = []
-        is_none_found = False
+        return f"{first_operand_str} in ({ ', '.join([self._visit_constant_node(c.value) for c in array])})"
 
-        for item in array:
-            if isinstance(item, ConstantNode):
-                if item.value is None:
-                    is_none_found = True
-                    continue
-                constant_nodes_without_none.append(item)
-
-        or_queries = []
-
-        if len(constant_nodes_without_none) > 0:
-            or_queries.append(
-                f"{first_operand_str} in ({ ', '.join([self._visit_constant_node(c.value, self._get_data_type_to_convert(first_operand)) for c in constant_nodes_without_none])})"
-            )
+    def _visit_contains_method_calling(
+        self, property_path: str, method_args: List[ConstantNode]
+    ) -> str:
+        raise NotImplementedError(
+            "'contains' method must be implemented in the child class"
+        )
 
-        if is_none_found:
-            or_queries.append(self._visit_equal(first_operand_str, "NULL"))
+    def _visit_starts_with_method_calling(
+        self, property_path: str, method_args: List[ConstantNode]
+    ) -> str:
+        raise NotImplementedError(
+            "'startsWith' method call must be implemented in the child class"
+        )
 
-        if len(or_queries) == 0:
-            return self._visit_constant_node(False)
+    def _visit_ends_with_method_calling(
+        self, property_path: str, method_args: List[ConstantNode]
+    ) -> str:
+        raise NotImplementedError(
+            "'endsWith' method call must be implemented in the child class"
+        )
 
-        final_query = or_queries[0]
+    def _visit_contains_method_calling(
+        self, property_path: str, method_args: List[ConstantNode]
+    ) -> str:
+        raise NotImplementedError(
+            "'contains' method must be implemented in the child class"
+        )
 
-        for query in or_queries[1:]:
-            final_query = self._visit_logical_or(final_query, query)
+    def _visit_starts_with_method_calling(
+        self, property_path: str, method_args: List[ConstantNode]
+    ) -> str:
+        raise NotImplementedError(
+            "'startsWith' method call must be implemented in the child class"
+        )
 
-        return final_query
+    def _visit_ends_with_method_calling(
+        self, property_path: str, method_args: List[ConstantNode]
+    ) -> str:
+        raise NotImplementedError(
+            "'endsWith' method call must be implemented in the child class"
+        )
 
     # endregion
 
-    def _visit_constant_node(self, value: Any, expected_data_type: type = None) -> str:
+    def _visit_constant_node(
+        self, value: Any, expected_data_type: DataType = None
+    ) -> str:
         if value is None:
             return "NULL"
         if isinstance(value, str):
@@ -390,7 +460,7 @@ def _visit_constant_node(self, value: Any, expected_data_type: type = None) -> s
 
         raise NotImplementedError(f"{type(value).__name__} constant type is not supported yet. Consider implementing this support in child class.")
 
-    def _get_data_type_to_convert(self, node: Node) -> type:
+    def _get_data_type_to_convert(self, node: Node) -> DataType:
         """
         Extracts data type from node.
         The data type will be used to convert the value of constant node into the expected type (SQL type).
@@ -404,12 +474,17 @@ def _get_data_type_to_convert(self, node: Node) -> type:
         if isinstance(node, ComparisonNode):
             return self._get_data_type_to_convert(node.first_operand)
 
+        if isinstance(node, CoalesceNode):
+            return None
+
         raise NotImplementedError(
             f"Cannot find data type to convert for {type(node).__name__} node"
         )
 
     # region Member Access Visitors
-    def _visit_multiple_fields_node(self, multiple_fields_node: MultipleFieldsNode, cast_to: type, stack) -> str:
+    def _visit_multiple_fields_node(
+        self, multiple_fields_node: MultipleFieldsNode, cast_to: DataType, stack
+    ) -> str:
         coalesce_args = []
 
         for item in multiple_fields_node.fields:
@@ -423,74 +498,29 @@ def _visit_multiple_fields_node(self, multiple_fields_node: MultipleFieldsNode,
 
         return self.coalesce(coalesce_args)
 
-    def _visit_member_access_node(self, member_access_node: MemberAccessNode, stack) -> str:
-        if isinstance(member_access_node, PropertyAccessNode):
-            if member_access_node.is_function_call():
-                method_access_node = member_access_node.get_method_access_node()
-                return self._visit_method_calling(
-                   self._visit_property_access_node(member_access_node, stack),
-                    method_access_node.member_name,
-                    method_access_node.args,
-                )
-
-            return self._visit_property_access_node(member_access_node, stack)
-
-        if isinstance(member_access_node, MethodAccessNode):
-            return self._visit_method_calling(
-                None, member_access_node.member_name, member_access_node.args
-            )
+    def _visit_property_access_node(
+        self, property_access_node: PropertyAccessNode, stack
+    ) -> str:
+        if isinstance(property_access_node, PropertyAccessNode):
+            return self._visit_property_access_node(property_access_node, stack)
 
         raise NotImplementedError(
-            f"{type(member_access_node).__name__} member access node is not supported yet"
+            f"{type(property_access_node).__name__} member access node is not supported yet"
         )
 
     def _visit_property_access_node(self, property_access_node: PropertyAccessNode, stack: list[Node]) -> str:
         if (isinstance(property_access_node, JsonPropertyAccessNode)):
             return self.json_extract_as_text(property_access_node.json_property_name, property_access_node.property_to_extract)
 
-        return ".".join(
-            [f"{item}" for item in property_access_node.get_property_path()]
-        )
+        return ".".join([f"{item}" for item in property_access_node.path])
 
     def _visit_index_property(self, property_path: str) -> str:
         raise NotImplementedError("Index property is not supported yet")
     # endregion
 
-    # region Method Calling Visitors
-    def _visit_method_calling(
-        self, property_path: str, method_name: str, method_args: List[str]
-    ) -> str:
-        if method_name == "contains":
-            return self._visit_contains_method_calling(property_path, method_args)
-
-        if method_name == "startsWith":
-            return self._visit_starts_with_method_calling(property_path, method_args)
-
-        if method_name == "endsWith":
-            return self._visit_ends_with_method_calling(property_path, method_args)
-
-        raise NotImplementedError(f"'{method_name}' method is not supported")
-
-    def _visit_contains_method_calling(
-        self, property_path: str, method_args: List[ConstantNode]
-    ) -> str:
-        raise NotImplementedError("'contains' method must be implemented in the child class")
-
-    def _visit_starts_with_method_calling(
-        self, property_path: str, method_args: List[ConstantNode]
-    ) -> str:
-        raise NotImplementedError("'startsWith' method call must be implemented in the child class")
-
-    def _visit_ends_with_method_calling(
-        self, property_path: str, method_args: List[ConstantNode]
-    ) -> str:
-        raise NotImplementedError("'endsWith' method call must be implemented in the child class")
-
-    # endregion
-
     # region Unary Visitors
     def _visit_unary_node(self, unary_node: UnaryNode, stack: list[Node]) -> str:
-        if unary_node.operator == UnaryNode.NOT:
+        if unary_node.operator == UnaryNodeOperator.NOT:
             return self._visit_unary_not(self.__build_sql_filter(unary_node.operand, stack))
 
         raise NotImplementedError(
diff --git a/keep/api/core/cel_to_sql/sql_providers/mysql.py b/keep/api/core/cel_to_sql/sql_providers/mysql.py
index 89f85d4cc5..3110bbc96f 100644
--- a/keep/api/core/cel_to_sql/sql_providers/mysql.py
+++ b/keep/api/core/cel_to_sql/sql_providers/mysql.py
@@ -1,7 +1,7 @@
 from datetime import datetime
 from typing import List
 from uuid import UUID
-from keep.api.core.cel_to_sql.ast_nodes import ConstantNode
+from keep.api.core.cel_to_sql.ast_nodes import ConstantNode, DataType
 from keep.api.core.cel_to_sql.properties_metadata import (
     JsonFieldMapping,
     SimpleFieldMapping,
@@ -14,14 +14,16 @@ def json_extract_as_text(self, column: str, path: list[str]) -> str:
         return f"JSON_UNQUOTE({self._json_extract(column, path)})"
 
     def cast(self, expression_to_cast: str, to_type, force=False):
-        if to_type is bool:
+        if to_type == DataType.BOOLEAN:
             cast_conditions = {
                 # f"{expression_to_cast} is NULL": "FALSE",
-                f"{expression_to_cast} = 'true'": "TRUE",
-                f"{expression_to_cast} = 'false'": "FALSE",
+                f"LOWER({expression_to_cast}) = 'true'": "TRUE",
+                f"LOWER({expression_to_cast}) = 'false'": "FALSE",
                 f"{expression_to_cast} = ''": "FALSE",
                 f"CAST({expression_to_cast} AS SIGNED) >= 1": "TRUE",
                 f"CAST({expression_to_cast} AS SIGNED) <= 0": "FALSE",
+                f"{expression_to_cast} IS NULL": "FALSE",
+                f"{expression_to_cast} IS NOT NULL": "TRUE",
             }
             result = " ".join(
                 [f"WHEN {key} THEN {value}" for key, value in cast_conditions.items()]
@@ -34,9 +36,9 @@ def cast(self, expression_to_cast: str, to_type, force=False):
             # so if not forced, we return the expression as is
             return expression_to_cast
 
-        if to_type is int:
+        if to_type == DataType.INTEGER:
             return f"CAST({expression_to_cast} AS SIGNED)"
-        elif to_type is float:
+        elif to_type == DataType.FLOAT:
             return f"CAST({expression_to_cast} AS DOUBLE)"
         else:
             return expression_to_cast
@@ -83,8 +85,10 @@ def _get_order_by_field(self, cel_sort_by: str):
         else:
             return field_expressions[0]
 
-    def _visit_constant_node(self, value: str, expected_data_type: type = None) -> str:
-        if expected_data_type is UUID:
+    def _visit_constant_node(
+        self, value: str, expected_data_type: DataType = None
+    ) -> str:
+        if expected_data_type is DataType.UUID:
             str_value = str(value)
             try:
                 # Because MySQL works with UUID without dashes, we need to convert it to a hex string
diff --git a/keep/api/core/cel_to_sql/sql_providers/postgresql.py b/keep/api/core/cel_to_sql/sql_providers/postgresql.py
index 7687ba620b..553846b310 100644
--- a/keep/api/core/cel_to_sql/sql_providers/postgresql.py
+++ b/keep/api/core/cel_to_sql/sql_providers/postgresql.py
@@ -1,5 +1,4 @@
 from datetime import datetime
-from types import NoneType
 from typing import List
 from uuid import UUID
 from keep.api.core.cel_to_sql.ast_nodes import ConstantNode
@@ -8,7 +7,7 @@
     SimpleFieldMapping,
 )
 from keep.api.core.cel_to_sql.sql_providers.base import BaseCelToSqlProvider
-
+from keep.api.core.cel_to_sql.ast_nodes import DataType
 
 class CelToPostgreSqlProvider(BaseCelToSqlProvider):
 
@@ -18,19 +17,19 @@ def json_extract_as_text(self, column: str, path: list[str]) -> str:
         json_property_path = " -> ".join(all_columns[:-1])
         return f"({json_property_path}) ->> {all_columns[-1]}"  # (json_column -> 'labels' -> tags) ->> 'service'
 
-    def cast(self, expression_to_cast: str, to_type, force=False):
-        if to_type is str:
+    def cast(self, expression_to_cast: str, to_type: DataType, force=False):
+        if to_type == DataType.STRING:
             to_type_str = "TEXT"
-        elif to_type is int or to_type is float:
+        elif to_type == DataType.INTEGER or to_type == DataType.FLOAT:
             to_type_str = "FLOAT"
-        elif to_type is NoneType:
+        elif to_type == DataType.NULL:
             return expression_to_cast
-        elif to_type is datetime:
+        elif to_type == DataType.DATETIME:
             to_type_str = "TIMESTAMP"
-        elif to_type is bool:
+        elif to_type == DataType.BOOLEAN:
             to_type_str = "BOOLEAN"
         else:
-            raise ValueError(f"Unsupported type: {type}")
+            raise ValueError(f"Unsupported type: {to_type}")
 
         return f"({expression_to_cast})::{to_type_str}"
 
@@ -48,7 +47,10 @@ def get_field_expression(self, cel_field):
                     field_mapping.json_prop, field_mapping.prop_in_json
                 )
 
-                if metadata.data_type is not str and metadata.data_type is not None:
+                if (
+                    metadata.data_type != DataType.STRING
+                    and metadata.data_type is not None
+                ):
                     json_exp = self.cast(json_exp, metadata.data_type)
                 field_expressions.append(json_exp)
                 continue
@@ -63,8 +65,10 @@ def get_field_expression(self, cel_field):
         else:
             return field_expressions[0]
 
-    def _visit_constant_node(self, value: str, expected_data_type: type = None) -> str:
-        if expected_data_type is UUID:
+    def _visit_constant_node(
+        self, value: str, expected_data_type: DataType = None
+    ) -> str:
+        if expected_data_type == DataType.UUID:
             str_value = str(value)
             try:
                 # Because PostgreSQL works with UUID with dashes, we need to convert it to a UUID with dashes string
diff --git a/keep/api/core/cel_to_sql/sql_providers/sqlite.py b/keep/api/core/cel_to_sql/sql_providers/sqlite.py
index f187aa80e9..fc4d679e73 100644
--- a/keep/api/core/cel_to_sql/sql_providers/sqlite.py
+++ b/keep/api/core/cel_to_sql/sql_providers/sqlite.py
@@ -1,9 +1,8 @@
 from datetime import datetime
-from types import NoneType
 from typing import List
 from uuid import UUID
 
-from keep.api.core.cel_to_sql.ast_nodes import ConstantNode
+from keep.api.core.cel_to_sql.ast_nodes import ConstantNode, DataType
 from keep.api.core.cel_to_sql.sql_providers.base import BaseCelToSqlProvider
 
 
@@ -13,36 +12,39 @@ def json_extract_as_text(self, column: str, path: list[str]) -> str:
         property_path_str = ".".join([f'"{item}"' for item in path])
         return f"json_extract({column}, '$.{property_path_str}')"
 
-    def cast(self, expression_to_cast: str, to_type, force=False):
-        if to_type is str:
+    def cast(self, expression_to_cast: str, to_type: DataType, force=False):
+        if to_type == DataType.STRING:
             to_type_str = "TEXT"
-        elif to_type is NoneType:
+        elif to_type == DataType.NULL:
             return expression_to_cast
-        elif to_type is int or to_type is float:
+        elif to_type == DataType.INTEGER or to_type == DataType.FLOAT:
             to_type_str = "REAL"
-        elif to_type is datetime:
+        elif to_type == DataType.DATETIME:
             return expression_to_cast
-        elif to_type is bool:
+        elif to_type == DataType.BOOLEAN:
             cast_conditions = {
-                # f"{expression_to_cast} is NULL": "FALSE",
-                f"{expression_to_cast} = 'true'": "TRUE",
-                f"{expression_to_cast} = 'false'": "FALSE",
+                f"LOWER({expression_to_cast}) = 'true'": "TRUE",
+                f"LOWER({expression_to_cast}) = 'false'": "FALSE",
                 f"{expression_to_cast} = ''": "FALSE",
                 f"CAST({expression_to_cast} AS SIGNED) >= 1": "TRUE",
                 f"CAST({expression_to_cast} AS SIGNED) <= 0": "FALSE",
+                f"{expression_to_cast} IS NULL": "FALSE",
+                f"{expression_to_cast} IS NOT NULL": "TRUE",
             }
             result = " ".join(
                 [f"WHEN {key} THEN {value}" for key, value in cast_conditions.items()]
             )
-            result = f"CASE {result} ELSE NULL END"
+            result = f"(CASE {result} ELSE NULL END)"
             return result
         else:
             raise ValueError(f"Unsupported type: {type}")
 
         return f"CAST({expression_to_cast} as {to_type_str})"
 
-    def _visit_constant_node(self, value: str, expected_data_type: type = None) -> str:
-        if expected_data_type is UUID:
+    def _visit_constant_node(
+        self, value: str, expected_data_type: DataType = None
+    ) -> str:
+        if expected_data_type == DataType.UUID:
             str_value = str(value)
             try:
                 # Because SQLite works with UUID without dashes, we need to convert it to a hex string
diff --git a/keep/api/core/facets.py b/keep/api/core/facets.py
index 1d94525f5f..a6601c79a5 100644
--- a/keep/api/core/facets.py
+++ b/keep/api/core/facets.py
@@ -2,6 +2,7 @@
 import logging
 from sqlalchemy import func, literal, literal_column, select, text
 from sqlalchemy.exc import OperationalError
+from keep.api.core.cel_to_sql.ast_nodes import DataType
 from keep.api.core.cel_to_sql.properties_metadata import (
     FieldMappingConfiguration,
     JsonFieldMapping,
@@ -118,7 +119,7 @@ def build_facets_data_query(
             elif isinstance(metadata.field_mappings[0], SimpleFieldMapping):
                 facet_value.append(item.map_to)
 
-        casted = f"{facets_cel_to_sql_instance.coalesce([facets_cel_to_sql_instance.cast(item, str) for item in facet_value])}"
+        casted = f"{facets_cel_to_sql_instance.coalesce([facets_cel_to_sql_instance.cast(item, DataType.STRING) for item in facet_value])}"
         facet_sub_query = (
             select(
                 literal(facet.id).label("facet_id"),
diff --git a/keep/api/core/incidents.py b/keep/api/core/incidents.py
index d0e1174b96..7c8b8e9fa3 100644
--- a/keep/api/core/incidents.py
+++ b/keep/api/core/incidents.py
@@ -31,12 +31,13 @@
 from keep.api.models.facet import FacetDto, FacetOptionDto, FacetOptionsQueryDto
 from keep.api.models.incident import IncidentSorting
 from keep.api.models.query import SortOptionsDto
+from keep.api.core.cel_to_sql.ast_nodes import DataType
 
 logger = logging.getLogger(__name__)
 
 incident_field_configurations = [
     FieldMappingConfiguration(
-        map_from_pattern="id", map_to=["incident.id"], data_type=UUID
+        map_from_pattern="id", map_to=["incident.id"], data_type=DataType.UUID
     ),
     FieldMappingConfiguration(
         map_from_pattern="name",
diff --git a/keep/api/routes/rules.py b/keep/api/routes/rules.py
index 0f2a897e45..36afefa376 100644
--- a/keep/api/routes/rules.py
+++ b/keep/api/routes/rules.py
@@ -3,6 +3,7 @@
 from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
 
+from keep.api.core.cel_to_sql.cel_ast_converter import CelToAstConverter
 from keep.api.core.db import create_rule as create_rule_db
 from keep.api.core.db import delete_rule as delete_rule_db
 from keep.api.core.db import get_rule_distribution as get_rule_distribution_db
@@ -56,6 +57,9 @@ def get_rules(
     for rule in rules:
         rule["distribution"] = rules_dist.get(rule["id"], [])
         rule["incidents"] = rules_incidents.get(rule["id"], 0)
+        rule["definition_cel_ast"] = CelToAstConverter().convert_to_ast(
+            rule["definition_cel"]
+        )
 
     return rules
 
diff --git a/tests/cel_to_sql/cel-to-sql-test-cases.json b/tests/cel_to_sql/cel-to-sql-test-cases.json
index 95ead586ee..cd6e5b23de 100644
--- a/tests/cel_to_sql/cel-to-sql-test-cases.json
+++ b/tests/cel_to_sql/cel-to-sql-test-cases.json
@@ -66,9 +66,9 @@
     "input_cel": "alert.some_json_prop.contains('lorem')",
     "description": "Contains operator with field refering to multiple JSON columns",
     "expected_sql_dialect_based": {
-      "sqlite": "(json_extract(alert_enrichments, '$.\"some_json_prop\"') IS NOT NULL AND json_extract(alert_enrichments, '$.\"some_json_prop\"') LIKE '%lorem%' OR json_extract(alert_event, '$.\"some_json_prop\"') IS NOT NULL AND json_extract(alert_event, '$.\"some_json_prop\"') LIKE '%lorem%')",
-      "mysql": "(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"')) IS NOT NULL AND LOWER(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"'))) LIKE '%lorem%' OR JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"')) IS NOT NULL AND LOWER(JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"'))) LIKE '%lorem%')",
-      "postgresql": "((alert_enrichments) ->> 'some_json_prop' IS NOT NULL AND (alert_enrichments) ->> 'some_json_prop' ILIKE '%lorem%' OR (alert_event) ->> 'some_json_prop' IS NOT NULL AND (alert_event) ->> 'some_json_prop' ILIKE '%lorem%')"
+      "sqlite": "COALESCE(json_extract(alert_enrichments, '$.\"some_json_prop\"'), json_extract(alert_event, '$.\"some_json_prop\"')) IS NOT NULL AND COALESCE(json_extract(alert_enrichments, '$.\"some_json_prop\"'), json_extract(alert_event, '$.\"some_json_prop\"')) LIKE '%lorem%'",
+      "mysql": "COALESCE(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"')), JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"'))) IS NOT NULL AND LOWER(COALESCE(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"')), JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"')))) LIKE '%lorem%'",
+      "postgresql": "COALESCE((alert_enrichments) ->> 'some_json_prop', (alert_event) ->> 'some_json_prop') IS NOT NULL AND COALESCE((alert_enrichments) ->> 'some_json_prop', (alert_event) ->> 'some_json_prop') ILIKE '%lorem%'"
     }
   },
   {
@@ -84,9 +84,9 @@
     "input_cel": "alert.some_json_prop.contains(100500)",
     "description": "Contains operator with arg not string",
     "expected_sql_dialect_based": {
-      "sqlite": "(json_extract(alert_enrichments, '$.\"some_json_prop\"') IS NOT NULL AND json_extract(alert_enrichments, '$.\"some_json_prop\"') LIKE '%100500%' OR json_extract(alert_event, '$.\"some_json_prop\"') IS NOT NULL AND json_extract(alert_event, '$.\"some_json_prop\"') LIKE '%100500%')",
-      "mysql": "(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"')) IS NOT NULL AND LOWER(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"'))) LIKE '%100500%' OR JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"')) IS NOT NULL AND LOWER(JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"'))) LIKE '%100500%')",
-      "postgresql": "((alert_enrichments) ->> 'some_json_prop' IS NOT NULL AND (alert_enrichments) ->> 'some_json_prop' ILIKE '%100500%' OR (alert_event) ->> 'some_json_prop' IS NOT NULL AND (alert_event) ->> 'some_json_prop' ILIKE '%100500%')"
+      "sqlite": "COALESCE(json_extract(alert_enrichments, '$.\"some_json_prop\"'), json_extract(alert_event, '$.\"some_json_prop\"')) IS NOT NULL AND COALESCE(json_extract(alert_enrichments, '$.\"some_json_prop\"'), json_extract(alert_event, '$.\"some_json_prop\"')) LIKE '%100500%'",
+      "mysql": "COALESCE(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"')), JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"'))) IS NOT NULL AND LOWER(COALESCE(JSON_UNQUOTE(JSON_EXTRACT(alert_enrichments, '$.\"some_json_prop\"')), JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"some_json_prop\"')))) LIKE '%100500%'",
+      "postgresql": "COALESCE((alert_enrichments) ->> 'some_json_prop', (alert_event) ->> 'some_json_prop') IS NOT NULL AND COALESCE((alert_enrichments) ->> 'some_json_prop', (alert_event) ->> 'some_json_prop') ILIKE '%100500%'"
     }
   },
   {
@@ -252,12 +252,30 @@
     }
   },
   {
-    "input_cel": "alert.tags['some tags.dot(&?:;'].tagKey == 'tag value'",
-    "description": "Index property access is with space and special chars",
+    "input_cel": "!!alert.isActive",
+    "description": "Negation of property",
     "expected_sql_dialect_based": {
-      "sqlite": "CAST(json_extract(alert_event, '$.\"tagsContainer\".\"some tags.dot(&?:;\".\"tagKey\"') as TEXT) = 'tag value'",
-      "mysql": "JSON_UNQUOTE(JSON_EXTRACT(alert_event, '$.\"tagsContainer\".\"some tags.dot(&?:;\".\"tagKey\"')) = 'tag value'",
-      "postgresql": "((alert_event -> 'tagsContainer' -> 'some tags.dot(&?:;') ->> 'tagKey')::TEXT = 'tag value'"
+      "sqlite": "",
+      "mysql": "",
+      "postgresql": ""
+    }
+  },
+  {
+    "input_cel": "id == '123e4567-e89b-12d3-a456-426614174000'",
+    "description": "UUID property access with dashed UUID",
+    "expected_sql_dialect_based": {
+      "sqlite": "entityId = '123e4567e89b12d3a456426614174000'",
+      "mysql": "entityId = '123e4567e89b12d3a456426614174000'",
+      "postgresql": "entityId = '123e4567-e89b-12d3-a456-426614174000'"
+    }
+  },
+  {
+    "input_cel": "id == '123e4567e89b12d3a456426614174000'",
+    "description": "UUID property access with HEX UUID",
+    "expected_sql_dialect_based": {
+      "sqlite": "entityId = '123e4567e89b12d3a456426614174000'",
+      "mysql": "entityId = '123e4567e89b12d3a456426614174000'",
+      "postgresql": "entityId = '123e4567-e89b-12d3-a456-426614174000'"
     }
   },
   {
diff --git a/tests/cel_to_sql/test_cel_to_ast.py b/tests/cel_to_sql/test_cel_to_ast.py
index 92481a7a82..78dcae5293 100644
--- a/tests/cel_to_sql/test_cel_to_ast.py
+++ b/tests/cel_to_sql/test_cel_to_ast.py
@@ -1,53 +1,81 @@
 import datetime
 import pytest
 
-from keep.api.core.cel_to_sql.ast_nodes import ComparisonNode, ConstantNode, LogicalNode, MethodAccessNode, ParenthesisNode, PropertyAccessNode, UnaryNode
+from keep.api.core.cel_to_sql.ast_nodes import (
+    ComparisonNode,
+    ComparisonNodeOperator,
+    ConstantNode,
+    LogicalNode,
+    LogicalNodeOperator,
+    ParenthesisNode,
+    PropertyAccessNode,
+    UnaryNode,
+    UnaryNodeOperator,
+)
 from keep.api.core.cel_to_sql.cel_ast_converter import CelToAstConverter
 
 
 @pytest.mark.parametrize(
     "cel, operator, expected_constant_type, expected_constant_value",
     [
-        ("fakeProp == 'fake alert'", ComparisonNode.EQ, str, "fake alert"),
+        ("fakeProp == 'fake alert'", ComparisonNodeOperator.EQ, str, "fake alert"),
         (
             "fakeProp == 'It\\'s value with escaped single-quote'",
-            ComparisonNode.EQ,
+            ComparisonNodeOperator.EQ,
             str,
             "It's value with escaped single-quote",
         ),
         (
             'fakeProp == "It\\"s value with escaped double-quote"',
-            ComparisonNode.EQ,
+            ComparisonNodeOperator.EQ,
             str,
             'It"s value with escaped double-quote',
         ),
-        ("fakeProp == true", ComparisonNode.EQ, bool, True),
-        ("fakeProp == 12349983", ComparisonNode.EQ, int, 12349983),
-        ("fakeProp == 1234.9983", ComparisonNode.EQ, float, 1234.9983),
+        ("fakeProp == true", ComparisonNodeOperator.EQ, bool, True),
+        ("fakeProp == 12349983", ComparisonNodeOperator.EQ, int, 12349983),
+        ("fakeProp == 1234.9983", ComparisonNodeOperator.EQ, float, 1234.9983),
         (
             "fakeProp == 'MON'",
-            ComparisonNode.EQ,
+            ComparisonNodeOperator.EQ,
             str,
             "MON",
         ),  # check that day-of-week short names do not get converted to dates
-        ("fakeProp == 'mon'", ComparisonNode.EQ, str, "mon"),
+        ("fakeProp == 'mon'", ComparisonNodeOperator.EQ, str, "mon"),
         (
             "fakeProp == '2025-01-20'",
-            ComparisonNode.EQ,
+            ComparisonNodeOperator.EQ,
             datetime.datetime,
             datetime.datetime(2025, 1, 20),
         ),
         (
             "fakeProp == '2025-01-20T14:35:27.123456'",
-            ComparisonNode.EQ,
+            ComparisonNodeOperator.EQ,
             datetime.datetime,
             datetime.datetime(2025, 1, 20, 14, 35, 27, 123456),
         ),
-        ("fakeProp != 'fake alert'", ComparisonNode.NE, str, "fake alert"),
-        ("fakeProp > 'fake alert'", ComparisonNode.GT, str, "fake alert"),
-        ("fakeProp >= 'fake alert'", ComparisonNode.GE, str, "fake alert"),
-        ("fakeProp < 'fake alert'", ComparisonNode.LT, str, "fake alert"),
-        ("fakeProp <= 'fake alert'", ComparisonNode.LE, str, "fake alert"),
+        ("fakeProp != 'fake alert'", ComparisonNodeOperator.NE, str, "fake alert"),
+        ("fakeProp > 'fake alert'", ComparisonNodeOperator.GT, str, "fake alert"),
+        ("fakeProp >= 'fake alert'", ComparisonNodeOperator.GE, str, "fake alert"),
+        ("fakeProp < 'fake alert'", ComparisonNodeOperator.LT, str, "fake alert"),
+        ("fakeProp <= 'fake alert'", ComparisonNodeOperator.LE, str, "fake alert"),
+        (
+            "fakeProp.contains('fake alert')",
+            ComparisonNodeOperator.CONTAINS,
+            str,
+            "fake alert",
+        ),
+        (
+            "fakeProp.startsWith('fake alert')",
+            ComparisonNodeOperator.STARTS_WITH,
+            str,
+            "fake alert",
+        ),
+        (
+            "fakeProp.endsWith('fake alert')",
+            ComparisonNodeOperator.ENDS_WITH,
+            str,
+            "fake alert",
+        ),
     ],
 )
 def test_simple_comparison_node(cel, operator, expected_constant_type, expected_constant_value):
@@ -56,7 +84,7 @@ def test_simple_comparison_node(cel, operator, expected_constant_type, expected_
     # Check that the root node is a ComparisonNode
     assert isinstance(actual, ComparisonNode)
     assert actual.operator == operator
-    
+
     # Check that second operand is a ConstantNode
     assert isinstance(actual.second_operand, ConstantNode)
     assert isinstance(actual.second_operand.value, expected_constant_type)
@@ -64,8 +92,7 @@ def test_simple_comparison_node(cel, operator, expected_constant_type, expected_
 
     # Check that first operand is a PropertyAccessNode
     assert isinstance(actual.first_operand, PropertyAccessNode)
-    assert actual.first_operand.member_name == "fakeProp"
-    assert actual.first_operand.value is None
+    assert actual.first_operand.path == ["fakeProp"]
 
 @pytest.mark.parametrize("cel, args", [
     ("fakeProp in ['string', 12345, true]", ["string", 12345, True]),
@@ -75,8 +102,8 @@ def test_simple_comparison_node_in(cel, args):
 
     # Check that the root node is a ComparisonNode
     assert isinstance(actual, ComparisonNode)
-    assert actual.operator == ComparisonNode.IN
-    
+    assert actual.operator == ComparisonNodeOperator.IN
+
     # Check that second operand is a list
     assert isinstance(actual.second_operand, list)
 
@@ -86,10 +113,14 @@ def test_simple_comparison_node_in(cel, args):
         assert type(arg.value) == type(args[i])
         assert arg.value == args[i]
 
-@pytest.mark.parametrize("cel, operator", [
-    ("!fakeProp", UnaryNode.NOT),
-    ("-fakeProp", UnaryNode.NEG),
-])
+
+@pytest.mark.parametrize(
+    "cel, operator",
+    [
+        ("!fakeProp", UnaryNodeOperator.NOT),
+        ("-fakeProp", UnaryNodeOperator.NEG),
+    ],
+)
 def test_simple_unary_node(cel, operator):
     actual = CelToAstConverter.convert_to_ast(cel)
 
@@ -99,13 +130,16 @@ def test_simple_unary_node(cel, operator):
 
     # Check that first operand is a PropertyAccessNode
     assert isinstance(actual.operand, PropertyAccessNode)
-    assert actual.operand.member_name == "fakeProp"
-    assert actual.operand.value is None
+    assert actual.operand.path == ["fakeProp"]
 
-@pytest.mark.parametrize("cel, operator", [
-    ("!firstFakeProp && !secondFakeProp", LogicalNode.AND),
-    ("!firstFakeProp || !secondFakeProp", LogicalNode.OR),
-])
+
+@pytest.mark.parametrize(
+    "cel, operator",
+    [
+        ("!firstFakeProp && !secondFakeProp", LogicalNodeOperator.AND),
+        ("!firstFakeProp || !secondFakeProp", LogicalNodeOperator.OR),
+    ],
+)
 def test_simple_logical_node(cel, operator):
     actual = CelToAstConverter.convert_to_ast(cel)
 
@@ -115,45 +149,27 @@ def test_simple_logical_node(cel, operator):
 
     # Check that left is UnaryNode with NOT operator
     assert isinstance(actual.left, UnaryNode)
-    assert actual.left.operator == UnaryNode.NOT
+    assert actual.left.operator == UnaryNodeOperator.NOT
 
     # Check that left.operand is PropertyAccessNode
     assert isinstance(actual.left.operand, PropertyAccessNode)
-    assert actual.left.operand.member_name == "firstFakeProp"
-    assert actual.left.operand.value is None
+    assert actual.left.operand.path == ["firstFakeProp"]
 
     # Check that right is UnaryNode with NOT operator
     assert isinstance(actual.right, UnaryNode)
-    assert actual.right.operator == UnaryNode.NOT
+    assert actual.right.operator == UnaryNodeOperator.NOT
 
     # Check that left.operand is PropertyAccessNode
     assert isinstance(actual.right.operand, PropertyAccessNode)
-    assert actual.right.operand.member_name == "secondFakeProp"
-    assert actual.right.operand.value is None
-
-@pytest.mark.parametrize("cel, method_name, args", [
-    ("fakeProp.contains('CPU')", "contains", ["CPU"]),
-    ("fakeProp.anything('string', 123, false)", "anything", ["string", 123, False]),
-])
-def test_method_access_node(cel, method_name, args):
-    actual = CelToAstConverter.convert_to_ast(cel)
-
-    # Check that the root node is a PropertyAccessNode where value is MethodAccessNode
-    assert isinstance(actual, PropertyAccessNode)
-    assert actual.member_name == "fakeProp"
-    assert isinstance(actual.value, MethodAccessNode)
-    assert actual.value.member_name == method_name
+    assert actual.right.operand.path == ["secondFakeProp"]
 
-    # Check that args are correct
-    for i, arg in enumerate(actual.value.args):
-        assert isinstance(arg, ConstantNode)
-        assert type(arg.value) == type(args[i])
-        assert arg.value == args[i]
-
-@pytest.mark.parametrize("cel, operator", [
-    ("!(fakeProp)", UnaryNode.NOT),
-    ("-(fakeProp)", UnaryNode.NEG),
-])
+@pytest.mark.parametrize(
+    "cel, operator",
+    [
+        ("!(fakeProp)", UnaryNodeOperator.NOT),
+        ("-(fakeProp)", UnaryNodeOperator.NEG),
+    ],
+)
 def test_parenthesis_node(cel, operator):
     actual = CelToAstConverter.convert_to_ast(cel)
 
@@ -166,5 +182,4 @@ def test_parenthesis_node(cel, operator):
 
     # Check that the operand.expression is PropertyAccessNode
     assert isinstance(actual.operand.expression, PropertyAccessNode)
-    assert actual.operand.expression.member_name == "fakeProp"
-    assert actual.operand.expression.value is None
+    assert actual.operand.expression.path == ["fakeProp"]
diff --git a/tests/cel_to_sql/test_cel_to_sql.py b/tests/cel_to_sql/test_cel_to_sql.py
index 4539b897e1..c5a495bc70 100644
--- a/tests/cel_to_sql/test_cel_to_sql.py
+++ b/tests/cel_to_sql/test_cel_to_sql.py
@@ -1,8 +1,8 @@
 import json
 import os
-from uuid import UUID
 import pytest
 
+from keep.api.core.cel_to_sql.ast_nodes import DataType
 from keep.api.core.cel_to_sql.properties_metadata import (
     FieldMappingConfiguration,
     PropertiesMetadata,
@@ -13,7 +13,7 @@
 
 fake_field_configurations = [
     FieldMappingConfiguration(
-        map_from_pattern="id", map_to=["entityId"], data_type=UUID
+        map_from_pattern="id", map_to=["entityId"], data_type=DataType.UUID
     ),
     FieldMappingConfiguration(
         map_from_pattern="name", map_to=["user_generated_name", "ai_generated_name"]
@@ -30,6 +30,19 @@
     FieldMappingConfiguration(
         map_from_pattern="alert.provider_type", map_to="incident_alert_provider_type"
     ),
+    FieldMappingConfiguration(
+        map_from_pattern="alert.isActive", map_to="alert_is_active"
+    ),
+    FieldMappingConfiguration(
+        map_from_pattern="dismissed",
+        map_to=["JSON(alert_event).dismissed"],
+        data_type=DataType.BOOLEAN,
+    ),
+    FieldMappingConfiguration(
+        map_from_pattern="deleted",
+        map_to=["JSON(alert_event).deleted"],
+        data_type=DataType.BOOLEAN,
+    ),
     FieldMappingConfiguration(
         map_from_pattern="alert.tags.*",
         map_to=["JSON(alert_event).tagsContainer.*"],
diff --git a/tests/cel_to_sql/test_order_by_exp.py b/tests/cel_to_sql/test_order_by_exp.py
index 13ad28457d..995c08fd7e 100644
--- a/tests/cel_to_sql/test_order_by_exp.py
+++ b/tests/cel_to_sql/test_order_by_exp.py
@@ -2,6 +2,7 @@
 import os
 import pytest
 
+from keep.api.core.cel_to_sql.ast_nodes import DataType
 from keep.api.core.cel_to_sql.properties_metadata import (
     FieldMappingConfiguration,
     PropertiesMetadata,
@@ -11,22 +12,24 @@
 )
 
 fake_field_configurations = [
-    FieldMappingConfiguration("floatNumberColumn", "float_number_column", float),
-    FieldMappingConfiguration("intNumberColumn", "int_number_column", int),
+    FieldMappingConfiguration(
+        "floatNumberColumn", "float_number_column", DataType.FLOAT
+    ),
+    FieldMappingConfiguration("intNumberColumn", "int_number_column", DataType.INTEGER),
     FieldMappingConfiguration(
         map_from_pattern="floatNumberColumnFromJson",
         map_to=["JSON(json_column).*"],
-        data_type=float,
+        data_type=DataType.FLOAT,
     ),
     FieldMappingConfiguration(
         map_from_pattern="intNumberColumnFromJson",
         map_to=["JSON(json_column).*"],
-        data_type=int,
+        data_type=DataType.INTEGER,
     ),
     FieldMappingConfiguration(
         map_from_pattern="intNumberColumnFromMultipleJson",
         map_to=["JSON(json_column_first).*", "JSON(json_column_second).*"],
-        data_type=int,
+        data_type=DataType.INTEGER,
     ),
     FieldMappingConfiguration(
         map_from_pattern="jsonPropWithoutType",
@@ -36,7 +39,7 @@
     FieldMappingConfiguration(
         map_from_pattern="stringJsonProp",
         map_to=["JSON(json_column_first).*"],
-        data_type=str,
+        data_type=DataType.STRING,
     ),
 ]
 properties_metadata = PropertiesMetadata(fake_field_configurations)