ti_opencti: fix pipeline errors due to access method from a null reference

[chemamartinez]

Proposed commit message

Pipeline tests were failing with the error:
"cannot access method/field [add] from a null def reference".

This failure was caused by script processors calling .add()
on fields whose parent object (threat.indicator) could be null.

The fix updates the ingest pipeline scripts to safely initialize
ctx.threat, ctx.threat.indicator, and the target array field before adding elements.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Closes [Serverless security] [ti_opencti] Failing test daily: pipeline test: test-file-with-name.json in ti_opencti.indicator #16049
• Closes [Serverless security] [ti_opencti] Failing test daily: pipeline test: test-url.json in ti_opencti.indicator #16052

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

This can be less verbose:

Suggested change

	if (ctx.threat == null) {
	ctx.threat = [:];
	}
	if (ctx.threat.indicator == null) {
	ctx.threat.indicator = [:];
	}
	if (ctx.threat.indicator.file == null) {
	ctx.threat.indicator.file = [];
	}
	ctx.threat = ctx.threat ?: [:];
	ctx.threat.indicator = ctx.threat.indicator ?: [:];
	ctx.threat.indicator.file = ctx.threat.indicator.file ?: [];

Also below.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 24c1be9

History

• 💚 Build #34695 succeeded 59fa687

cc @chemamartinez

[elastic-vault-github-plugin-prod]

Package ti_opencti - 2.10.1 containing this change is available at https://epr.elastic.co/package/ti_opencti/2.10.1/