ti_opencti: fix pipeline errors due to access method from a null reference (#16129)

Pipeline tests were failing with the error:
"cannot access method/field [add] from a null def reference".

This failure was caused by script processors calling .add()
on fields whose parent object (threat.indicator) could be null.

The fix updates the ingest pipeline scripts to safely initialize
ctx.threat, ctx.threat.indicator, and the target array field before adding elements.

Author: chemamartinez

packages/ti_opencti/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.10.1"
+  changes:
+    - description: Fix null reference errors in ingest pipelines.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/16129
 - version: "2.10.0"
   changes:
     - description: Add comprehensive filtering support for indicators including pattern types, confidence levels, labels, dates, authors, creators, and marking definitions.

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_artifact.yml

@@ -48,13 +48,13 @@ processors:
       ignore_empty_value: true
 
   # append object
-  - append:
-      field: threat.indicator.file
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.file = ctx.threat.indicator.file ?: [];
         ctx.threat.indicator.file.add(ctx._tmp_file);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_autonomous_system.yml

@@ -11,13 +11,13 @@ processors:
       value: "{{{_ingest._value.name}}}"
 
   # append object
-  - append:
-      field: threat.indicator.as
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.as = ctx.threat.indicator.as ?: [];
         ctx.threat.indicator.as.add(ctx._tmp_as);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_directory.yml

@@ -28,13 +28,13 @@ processors:
       ignore_empty_value: true
 
   # append object
-  - append:
-      field: threat.indicator.file
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.file = ctx.threat.indicator.file ?: [];
         ctx.threat.indicator.file.add(ctx._tmp_file);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_domain_name_or_hostname.yml

@@ -12,13 +12,13 @@ processors:
       ignore_missing: true
 
   # append object
-  - append:
-      field: threat.indicator.url
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.url = ctx.threat.indicator.url ?: [];
         ctx.threat.indicator.url.add(ctx._tmp_url);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_file.yml

@@ -91,13 +91,13 @@ processors:
       ignore_empty_value: true
 
   # append object
-  - append:
-      field: threat.indicator.file
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.file = ctx.threat.indicator.file ?: [];
         ctx.threat.indicator.file.add(ctx._tmp_file);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_url_field.yml

@@ -26,13 +26,13 @@ processors:
       copy_from: _tmp_url.original
 
   # append object
-  - append:
-      field: threat.indicator.url
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.url = ctx.threat.indicator.url ?: [];
         ctx.threat.indicator.url.add(ctx._tmp_url);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_windows_registry_key.yml

@@ -24,13 +24,13 @@ processors:
       if: ctx._tmp_registry?.hive != null
 
   # append object
-  - append:
-      field: threat.indicator.registry
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.registry = ctx.threat.indicator.registry ?: [];
         ctx.threat.indicator.registry.add(ctx._tmp_registry);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_windows_registry_value_type.yml

@@ -15,13 +15,13 @@ processors:
       value: "{{{_ingest._value.data}}}"
 
   # append object
-  - append:
-      field: threat.indicator.registry
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.registry = ctx.threat.indicator.registry ?: [];
         ctx.threat.indicator.registry.add(ctx._tmp_registry);
 
   - remove:

packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/ecs_from_x509_certificate.yml

@@ -43,13 +43,13 @@ processors:
       value: "{{{_ingest._value.version}}}"
 
   # append object
-  - append:
-      field: threat.indicator.x509
-      value: []
   - script:
       description: Append to the destination
       lang: painless
       source: |
+        ctx.threat = ctx.threat ?: [:];
+        ctx.threat.indicator = ctx.threat.indicator ?: [:];
+        ctx.threat.indicator.x509 = ctx.threat.indicator.x509 ?: [];
         ctx.threat.indicator.x509.add(ctx._tmp_x509);
 
   - remove: