Elastic Defend Response Actions Null Pointer Exception

[senatesan]

Version

Other (please provide detail below)

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

100

Storage for /

2TB

Storage for /nsm

1.7TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

SO 2.4.141, with Elastic Enterprise license.

While testing Elastic Security Response Actions, I receive the following Internal Server Error 500

Actual Behavior:

Expected Result:

This seems to be caused by a missing Null check in the 'global@custom' pipeline.

Fix:
I took this part of the 'global@custom' pipeline:

{ "split":      { "if": "ctx.data_stream?.dataset.contains('.')", "field":"data_stream.dataset", "separator":"\\.", "target_field":"datastream_dataset_temp", "ignore_missing":true } },

and replaced it with:

{ "split":      { "if": "ctx.data_stream?.dataset != null && ctx.data_stream?.dataset.contains('.')", "field":"data_stream.dataset", "separator":"\\.", "target_field":"datastream_dataset_temp", "ignore_missing":true } },

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

Thanks for surfacing! We will look at getting this into the next release #14602