imperva_cloud_waf: work around type mismatch

[efd6]

Proposed commit message

See title.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Since the input is not tested, the behaviour change here can be checked with the two CEL programs below, good.cel (new code) and bad.cel (original code) that reflect the defective code region in the agent configuration with minor modifications to allow it to run without an endpoint.

$ mito bad.cel 
failed program instantiation: failed compilation: ERROR: <input>:5:71: found no matching overload for '_?_:_' applied to '(bool, list(map(string, string)), list(map(string, map(string, string))))'
 |  "events": try(string(body), "error").as(body, type(body) == type("") ?
 | ......................................................................^
$ mito good.cel
[
	{
		"events": [
			{
				"error": {
					"message": "invalid UTF-8 in bytes, cannot convert to string: check imperva waf logging is configured correctly"
				}
			}
		]
	},
	{
		"events": [
			{
				"message": "good message"
			}
		]
	}
]

good.cel:

[
	b"\xc3\x28",
	b"|==|good message\n",
].map(body, {
	"events": try(string(body), "error").as(body, type(body) == type("") ?
		dyn((body+"|==|").split("|==|")[1].split("\n").filter(x,x!="").map(x,{"message":x}))
	:
		// This is an unrecoverable error for the worklist element; it indicates
		// most likely that the data was compressed, or was encrypted. We cannot
		// handle this, so we step past it and log the failure. We are in an
		// unfortunate position where ideally we would like this to cause a health
		// status note in fleet to result, but we cannot do this since this would
		// delete the cursor update and we would still be stuck here, so we just
		// log into the index in the hope that someone will see it.
		dyn([{"error":
			{
				"message": body.error + ": check imperva waf logging is configured correctly",
			},
		}])
	),
})

bad.cel:

[
	b"\xc3\x28",
	b"|==|good message\n",
].map(body, {
	"events": try(string(body), "error").as(body, type(body) == type("") ?
		(body+"|==|").split("|==|")[1].split("\n").filter(x,x!="").map(x,{"message":x})
	:
		// This is an unrecoverable error for the worklist element; it indicates
		// most likely that the data was compressed, or was encrypted. We cannot
		// handle this, so we step past it and log the failure. We are in an
		// unfortunate position where ideally we would like this to cause a health
		// status note in fleet to result, but we cannot do this since this would
		// delete the cursor update and we would still be stuck here, so we just
		// log into the index in the hope that someone will see it.
		[{"error":
			{
				"message": body.error + ": check imperva waf logging is configured correctly",
			},
		}]
	),
})

Related issues

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package imperva_cloud_waf 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
event	1589.83	1291.99	-297.84 (-18.73%)	💔

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 959933b

cc @efd6

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

Package imperva_cloud_waf - 1.11.1 containing this change is available at https://epr.elastic.co/package/imperva_cloud_waf/1.11.1/