imperva_cloud_waf: fix CEL type guard for events field access by chemamartinez · Pull Request #19013 · elastic/integrations

chemamartinez · 2026-05-14T17:00:58Z

Proposed commit message

imperva_cloud_waf: fix CEL type guard for events field access

The guard has(v.?events.error) at the outer .as(v, ...) expression is
intended to detect error responses, where events is a map
{"error": {...}}. When the worklist has multiple entries, the
worklist-continuation branch returns state wholesale, carrying the
previous iteration's list-valued events into v. CEL then attempts
string-key field access (.error) on that list and throws "unsupported
index type 'string' in list", cycling the input unit HEALTHY→DEGRADED
on every poll and halting ingestion entirely.

This is triggered in practice when the Imperva API delivers non-WAF
event types (e.g. Client-Side Protection SIEM events) alongside WAF
logs through the same endpoint, as the additional log volume increases
the likelihood of a multi-file worklist.

Add an explicit type check before the field access so that .error is
only accessed when v.events is actually a map.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

infra-vault-gh-plugin-prod · 2026-05-14T17:03:43Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

chrisberkhout

The commit message seems to contradict itself:

On the success path events is always a list, so the check is normally safe.
However, when ..., v.events can be a list at the point of the guard.

The change of checking the type of the events makes sense.

chrisberkhout · 2026-05-20T14:45:58Z

         }
      )
-  ).as(v, has(v.?events.error) ?
+  ).as(v, has(v.?events) && type(v.events) == map && has(v.?events.error) ?


I think the optional syntax is redundant. Checking field presence should be enough.

Suggested change

).as(v, has(v.?events) && type(v.events) == map && has(v.?events.error) ?

).as(v, has(v.events) && type(v.events) == map && has(v.events.error) ?

I think (tested) this test can be reduced to type(v.?events.orValue(null)) == map; if it's absent, the type is null, if it present then the type gets made concrete and we can compare to the literal type.

github-actions · 2026-05-21T14:06:14Z

TL;DR

Check integrations imperva_cloud_waf is failing in static tests because sample_event.json now uses GeoJSON-style source.geo.location (coordinates/type), but this package expects ECS geo_point shape (lat/lon). Revert that field shape and rerun the package checks.

Remediation

In packages/imperva_cloud_waf/data_stream/event/sample_event.json, change source.geo.location back to ECS geo_point object keys (lat and lon) instead of coordinates/type.
Keep packages/imperva_cloud_waf/docs/README.md example aligned with sample_event.json after the fix.
Re-run: elastic-package test static -v --report-format xUnit --report-output file from packages/imperva_cloud_waf.

Investigation details

Root Cause

The sample event was changed to:

packages/imperva_cloud_waf/data_stream/event/sample_event.json:135-141
packages/imperva_cloud_waf/docs/README.md:210-216

with:

source.geo.location.coordinates
source.geo.location.type

Static validation rejects those fields for this package/event.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/43243
Job/step: Check integrations imperva_cloud_waf
Key log excerpt (xUnit from static test):

<testcase name="static test: Verify sample_event.json" classname="imperva_cloud_waf.event">
  <failure>... [0] field "source.geo.location.coordinates" is undefined ...
  [1] field "source.geo.location.type" is undefined ...</failure>
</testcase>

Source: build/test-results/imperva_cloud_waf-static-*.xml (failure element).

Verification

Reproduced static failure on commit 7376cc1e6007be4d45b89787bec7c990965a8917 with:
- elastic-package test static -v --report-format xUnit --report-output file
Full asset/pipeline verification was not run in this environment because Docker daemon is unavailable.

Follow-up

After updating source.geo.location to ECS-compatible shape, rerun the Buildkite package check to confirm green.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

imperva_cloud_waf: fix CEL type guard for events field access #19013 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19013 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

chrisberkhout

CEL change looks good.

For a second I wondered if I was wrong about removing the optional syntax on the latter part of the condition, but that seems fine:

mito -data <(echo '{"events": []}')            <(echo 'type(state.?events.orValue(null)) == map && has(state.events.error)')
mito -data <(echo '{"events": {"error": {}}}') <(echo 'type(state.?events.orValue(null)) == map && has(state.events.error)')
mito -data <(echo '{"events": null}')          <(echo 'type(state.?events.orValue(null)) == map && has(state.events.error)')

false
true
false

The build error is:

test case failed: one or more errors found in document: [0] field "source.geo.location.coordinates" is undefined, could be a multifield
[1] field "source.geo.location.type" is undefined, could be a multifield

chemamartinez · 2026-05-21T16:25:37Z

CEL change looks good.

For a second I wondered if I was wrong about removing the optional syntax on the latter part of the condition, but that seems fine:
mito -data <(echo '{"events": []}')            <(echo 'type(state.?events.orValue(null)) == map && has(state.events.error)')
mito -data <(echo '{"events": {"error": {}}}') <(echo 'type(state.?events.orValue(null)) == map && has(state.events.error)')
mito -data <(echo '{"events": null}')          <(echo 'type(state.?events.orValue(null)) == map && has(state.events.error)')
false
true
false
The build error is:

test case failed: one or more errors found in document: [0] field "source.geo.location.coordinates" is undefined, could be a multifield
[1] field "source.geo.location.type" is undefined, could be a multifield

Thanks for checking, exactly, regenerating sample_event.json created some non-ECS fields. I've restored the old version as it is unrelated to this change.

elasticmachine · 2026-05-21T16:53:09Z

💚 Build Succeeded

Buildkite Build
Commit: 5dd390c

History

💔 Build #43243 failed 7376cc1
💔 Build #42945 failed 51a2f08
💔 Build #42883 failed 4c3db41

cc @chemamartinez

elastic-vault-github-plugin-prod · 2026-05-25T07:33:47Z

Package imperva_cloud_waf - 1.13.2 containing this change is available at https://epr.elastic.co/package/imperva_cloud_waf/1.13.2/

…c#19013) imperva_cloud_waf: fix CEL type guard for events field access The guard has(v.?events.error) at the outer .as(v, ...) expression is intended to detect error responses, where events is a map {"error": {...}}. When the worklist has multiple entries, the worklist-continuation branch returns state wholesale, carrying the previous iteration's list-valued events into v. CEL then attempts string-key field access (.error) on that list and throws "unsupported index type 'string' in list", cycling the input unit HEALTHY→DEGRADED on every poll and halting ingestion entirely. This is triggered in practice when the Imperva API delivers non-WAF event types (e.g. Client-Side Protection SIEM events) alongside WAF logs through the same endpoint, as the additional log volume increases the likelihood of a multi-file worklist. Add an explicit type check before the field access so that .error is only accessed when v.events is actually a map.

Fix CEL type guard for events field access

ff77c6e

chemamartinez self-assigned this May 14, 2026

chemamartinez added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:imperva_cloud_waf Imperva Cloud WAF labels May 14, 2026

chemamartinez marked this pull request as ready for review May 14, 2026 17:03

chemamartinez requested a review from a team as a code owner May 14, 2026 17:03

Update changelog

51a2f08

chemamartinez force-pushed the imperva-cloud-waf-fix-cel-type-guard branch from 4c3db41 to 51a2f08 Compare May 15, 2026 13:56

github-actions Bot mentioned this pull request May 15, 2026

[aws] add agentless deployment for AWS Kafka #19036

Closed

5 tasks

chrisberkhout requested changes May 20, 2026

View reviewed changes

Add requested changes

7376cc1

chemamartinez requested a review from a team as a code owner May 21, 2026 13:23

chemamartinez requested review from chrisberkhout and efd6 May 21, 2026 13:29

This comment has been minimized.

Sign in to view

chrisberkhout reviewed May 21, 2026

View reviewed changes

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label May 21, 2026

Restore sample_event.json

5dd390c

chemamartinez requested a review from chrisberkhout May 21, 2026 16:25

andrewkroh removed the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label May 21, 2026

chrisberkhout approved these changes May 22, 2026

View reviewed changes

efd6 approved these changes May 25, 2026

View reviewed changes

chemamartinez merged commit af30af3 into elastic:main May 25, 2026
8 checks passed

github-actions Bot mentioned this pull request May 25, 2026

[breaking-change] Undocumented breaking changes detected (2026-05-25) #19189

Open

3 tasks

Navigation Menu

Uh oh!

imperva_cloud_waf: fix CEL type guard for events field access - #19013

imperva_cloud_waf: fix CEL type guard for events field access#19013
chemamartinez merged 4 commits into
elastic:mainfrom
chemamartinez:imperva-cloud-waf-fix-cel-type-guard

chemamartinez commented May 14, 2026 •

edited

Loading

infra-vault-gh-plugin-prod Bot commented May 14, 2026

chrisberkhout left a comment

chrisberkhout May 20, 2026

efd6 May 20, 2026

This comment has been minimized.

github-actions Bot commented May 21, 2026

Root Cause

Evidence

Verification

Follow-up

chrisberkhout left a comment

chemamartinez commented May 21, 2026

elasticmachine commented May 21, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 25, 2026

Labels

5 participants

	).as(v, has(v.?events) && type(v.events) == map && has(v.?events.error) ?
	).as(v, has(v.events) && type(v.events) == map && has(v.events.error) ?

Uh oh!

Conversation

chemamartinez commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

infra-vault-gh-plugin-prod Bot commented May 14, 2026

chrisberkhout left a comment

Choose a reason for hiding this comment

chrisberkhout May 20, 2026

Choose a reason for hiding this comment

efd6 May 20, 2026

Choose a reason for hiding this comment

This comment has been minimized.

github-actions Bot commented May 21, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

chrisberkhout left a comment

Choose a reason for hiding this comment

chemamartinez commented May 21, 2026

elasticmachine commented May 21, 2026

💚 Build Succeeded

History

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 25, 2026

Labels

5 participants

chemamartinez commented May 14, 2026 •

edited

Loading