[ZScaler ZPA] Fix PosturesHit and PosturesMiss parsing

[srilumpa]

What does this PR do?

As described in #5537, ZScaler Private Access Postures fields are not properly parsed and the related processors fail silently. This PR fixes this by checking if the field is a string or a list and apply the adequate processor.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• Pipeline properly proceeds log with PosturesHit and PosturesMiss as Strings (current behaviour)
• Pipeline properly proceeds log with PosturesHit and PosturesMiss as Lists (expected behaviour)

How to test this PR locally

1. Start the Elastic stack: elastic-package.exe stack up -v -d
2. Setup environment: \elastic-package stack shellinit
3. Run unit tests: elastic-package.exe test pipeline -v

Related issues

• Closes [ZScaler ZPA] UserStatus - Processing errors for PostureHits and PostureMiss fields #5537

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-04-17T08:48:55.774+0000

• Duration: 18 min 30 sec

Test stats 🧪

Test	Results
Failed	0
Passed	30
Skipped	0
Total	30

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[ShourieG]

/test

[ShourieG]

@srilumpa can you update the version under manifest.yml to "1.5.3". Otherwise its failing our CI checks

[srilumpa]

My bad, I forgot to update this field too.

[bhapas]

/test

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (5/5)	💚
Files	100.0% (5/5)	💚
Classes	100.0% (5/5)	💚
Methods	100.0% (59/59)	💚
Lines	90.278% (1560/1728)	❕
Conditionals	100.0% (0/0)	💚

[andrewkroh]

LGTM. What version of ZPA are you running where you observed the Postures{Hit,Miss} that were lists? Did the format of these fields change between versions?

[srilumpa]

Unfortunately, I can't tell you as I don't have those informations. We transmitted the configuration requested by the Elastic's integration documentation to the ones in charge of the appliance configuration and they configured the log forwarding accordingly. I don't think there were any version changes since then.

[srilumpa]

Hello, I have just updated the branch with the last main version and fix the conflicts. Are there some additional steps or missing informations that I could provide to proceed with this PR?

[jamiehynds]

Thanks @srilumpa. @ShourieG @bhapas are we ok to merge this PR?

[bhapas]

LGTM

[elasticmachine]

Package zscaler_zpa - 1.6.1 containing this change is available at https://epr.elastic.co/search?package=zscaler_zpa