add null check while adding fetched iocs into per-indicator-type map

Signed-off-by: Surya Sashank Nistala <snistala@amazon.com>
eirsep · Oct 2, 2024 · f1dae21 · f1dae21
1 parent 7017328
commit f1dae21
Showing 1 changed file with 18 additions and 16 deletions.
diff --git a/...ain/java/org/opensearch/securityanalytics/threatIntel/iocscan/service/IoCScanService.java b/...ain/java/org/opensearch/securityanalytics/threatIntel/iocscan/service/IoCScanService.java
@@ -133,23 +133,25 @@ abstract void matchAgainstThreatIntelAndReturnMaliciousIocs(
                 ) {
                     // if concrete index resolves to multiple monitor input indices, it's undesirable. We just pick any one of the monitor input indices to get fields for each ioc.
                     String index = context.getConcreteIndexToMonitorInputIndicesMap().get(concreteIndex).get(0);
-                    List<String> fields = iocTypeToIndexFieldMapping.getIndexToFieldsMap().get(index);
-                    for (String field : fields) {
-                        List<String> vals = getValuesAsStringList(datum, field);
-                        String id = getId(datum);
-                        String docId = id + ":" + index;
-                        Set<String> iocs = docIdToIocsMap.getOrDefault(docId, new HashSet<>());
-                        iocs.addAll(vals);
-                        docIdToIocsMap.put(docId, iocs);
-                        for (String ioc : vals) {
-                            Set<String> docIds = iocValueToDocIdMap.getOrDefault(ioc, new HashSet<>());
-                            docIds.add(docId);
-                            iocValueToDocIdMap.put(ioc, docIds);
-                        }
-                        if (false == vals.isEmpty()) {
-                            iocs = iocsPerIocTypeMap.getOrDefault(iocType, new HashSet<>());
+                    List<String> fieldsConfiguredInMonitorForCurrentIndex = iocTypeToIndexFieldMapping.getIndexToFieldsMap().get(index);
+                    if(fieldsConfiguredInMonitorForCurrentIndex != null && false == fieldsConfiguredInMonitorForCurrentIndex.isEmpty()) {
+                        for (String field : fieldsConfiguredInMonitorForCurrentIndex) {
+                            List<String> vals = getValuesAsStringList(datum, field);
+                            String id = getId(datum);
+                            String docId = id + ":" + index;
+                            Set<String> iocs = docIdToIocsMap.getOrDefault(docId, new HashSet<>());
                             iocs.addAll(vals);
-                            iocsPerIocTypeMap.put(iocType, iocs);
+                            docIdToIocsMap.put(docId, iocs);
+                            for (String ioc : vals) {
+                                Set<String> docIds = iocValueToDocIdMap.getOrDefault(ioc, new HashSet<>());
+                                docIds.add(docId);
+                                iocValueToDocIdMap.put(ioc, docIds);
+                            }
+                            if (false == vals.isEmpty()) {
+                                iocs = iocsPerIocTypeMap.getOrDefault(iocType, new HashSet<>());
+                                iocs.addAll(vals);
+                                iocsPerIocTypeMap.put(iocType, iocs);
+                            }
                         }
                     }
                 }