[ti_misp] - Fix silent loss of URL indicators when uri_parts parsing fails

[ShourieG]

Type of change

• Bug

Proposed commit message

packages/ti_misp: Fix silent loss of URL indicators when uri_parts parsing fails

When misp.attribute.type is "url" and the value cannot be parsed by the
uri_parts processor (e.g. defanged URLs like hxxp://), the processor
silently fails due to ignore_failure: true. This leaves
threat.indicator.url.full and threat.indicator.url.original unset, and
the cleanup step then removes misp.attribute.value, resulting in the URL
being lost entirely from the document.

Add fallback set processors to both threat_attributes and threat
pipelines that copy misp.attribute.value directly into
threat.indicator.url.full and threat.indicator.url.original when
uri_parts fails to populate them.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9b89db0

cc @ShourieG

[elastic-vault-github-plugin-prod]

Package ti_misp - 1.41.4 containing this change is available at https://epr.elastic.co/package/ti_misp/1.41.4/