improve IP address handling

Author: efd6

packages/crowdstrike/changelog.yml

@@ -4,6 +4,9 @@
  - description: Fix network direction handling for FDR data stream.
  type: bugfix
  link: https://github.com/elastic/integrations/pull/12508
+ - description: Handle invalid IP addresses robustly.
+ type: bugfix
+ link: https://github.com/elastic/integrations/pull/12508
 - version: "1.49.0"
  changes:
  - description: Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error".

packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml

@@ -17,6 +17,18 @@ processors:
  field: destination.ip
  if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0
  value: '{{{crowdstrike.LocalAddressIP6.0}}}'
+ - convert:
+ tag: convert_destination_ip
+ field: destination.ip
+ type: ip
+ ignore_missing: true
+ on_failure:
+ - remove:
+ field: destination.ip
+ ignore_missing: true
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - set:
  field: destination.address
  copy_from: destination.ip
@@ -36,6 +48,18 @@ processors:
  target_field: destination.mac
  ignore_missing: true
 
+ - convert:
+ tag: convert_RemoteAddressIP4_ip
+ field: crowdstrike.RemoteAddressIP4
+ type: ip
+ ignore_missing: true
+ on_failure:
+ - remove:
+ field: crowdstrike.RemoteAddressIP4
+ ignore_missing: true
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - rename:
  field: crowdstrike.RemoteAddressIP4
  target_field: source.ip
@@ -45,6 +69,13 @@ processors:
  field: crowdstrike.RemoteAddressIP6
  type: ip
  ignore_missing: true
+ on_failure:
+ - remove:
+ field: crowdstrike.RemoteAddressIP6
+ ignore_missing: true
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - rename:
  field: crowdstrike.RemoteAddressIP6
  target_field: source.ip

packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml

@@ -17,6 +17,18 @@ processors:
  field: source.ip
  if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0
  value: '{{{crowdstrike.LocalAddressIP6.0}}}'
+ - convert:
+ tag: convert_source_ip
+ field: source.ip
+ type: ip
+ ignore_missing: true
+ on_failure:
+ - remove:
+ field: source.ip
+ ignore_missing: true
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - set:
  field: source.address
  copy_from: source.ip
@@ -36,6 +48,18 @@ processors:
  target_field: source.mac
  ignore_missing: true
 
+ - convert:
+ tag: convert_RemoteAddressIP4_ip
+ field: crowdstrike.RemoteAddressIP4
+ type: ip
+ ignore_missing: true
+ on_failure:
+ - remove:
+ field: crowdstrike.RemoteAddressIP4
+ ignore_missing: true
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - rename:
  field: crowdstrike.RemoteAddressIP4
  target_field: destination.ip
@@ -45,6 +69,13 @@ processors:
  field: crowdstrike.RemoteAddressIP6
  type: ip
  ignore_missing: true
+ on_failure:
+ - remove:
+ field: crowdstrike.RemoteAddressIP6
+ ignore_missing: true
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - rename:
  field: crowdstrike.RemoteAddressIP6
  target_field: destination.ip