You are writing a YARA-L single-event rule to detect suspicious values in a vendor-specific field that your parser stored in the UDM additional.fields map (a key/value map) rather than a first-class UDM field. During testing, the rule compiles but never fires even though matching events clearly exist in the data. Which correction is most likely required for the rule to evaluate the map value correctly?