Problem child ingest pipeline bug

[r0ot]

Proposed commit message

The painless script if block serving as the entry point into the problem child inference pipeline has a bug in its logic checking for the appropriate host operating system. It separates its checks for various sub-fields of host.os and it's actual accessing of those fields from the ctx object, potentially leading to errors trying to access keys that don't exist.

For example, if a document contains host.os.family but doesn't contain host.os.type, this painless script will raise an error instead of simply failing.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[sodhikirti07]

@r0ot Could you provide an example document that is causing the pipeline errors?

[r0ot]

@r0ot Could you provide an example document that is causing the pipeline errors?

I don't have a real-world document I could provide but the example I gave in my description should be sufficient. If the user's datasource isn't elastic endpoint and only provided host.os.family or host.os.platform without host.os.type it would trigger this bug.

[susan-shu-c]

Hi, @r0ot we are testing this, can you also share what Elastic stack version you are using, as well as the ProblemChild/Living off the Land Detection package version you are on?

[r0ot]

Upon testing, this doesn't raise an error like I thought, it rather just returns false. The notation used here could be cleaned up with ?. accesses to make the logic more concise and avoid confusion in the future. I've updated this PR with the updated notation.

So not a bug but an improvement.

[susan-shu-c]

Hi, thanks again for the PR; for now we're considering rolling this up into the next release we make for this package. Will keep you posted!

[qcorporation]

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[andrewkroh]

/test

[andrewkroh]

LGTM

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: ebfad24

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[elastic-vault-github-plugin-prod]

Package problemchild - 2.2.0 containing this change is available at https://epr.elastic.co/package/problemchild/2.2.0/