Skip to content

ti_google_threat_intelligence: fix null array handling in CEL programs#19436

Merged
navnit-elastic merged 2 commits into
elastic:mainfrom
navnit-elastic:gti-null-results
Jun 8, 2026
Merged

ti_google_threat_intelligence: fix null array handling in CEL programs#19436
navnit-elastic merged 2 commits into
elastic:mainfrom
navnit-elastic:gti-null-results

Conversation

@navnit-elastic

@navnit-elastic navnit-elastic commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

ti_google_threat_intelligence: fix null array handling in CEL programs

Add explicit null checks before size() on body.iocs and body.data across
all threat list data streams so APIs returning null instead of an empty
array no longer cause runtime failures.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@navnit-elastic navnit-elastic self-assigned this Jun 8, 2026
@navnit-elastic navnit-elastic added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Integration:ti_google_threat_intelligence Google Threat Intelligence (Partner supported) labels Jun 8, 2026
@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

TL;DR

This failure is an infrastructure/transient dependency fetch issue, not a PR code regression. The Buildkite trigger job failed because gvm download returned an HTML 504 Gateway Time-out, so go was never installed and the step exited with 127.

Remediation

  • Re-run the failed Buildkite build/job (likely transient network/proxy outage to GitHub Releases).
  • Harden .buildkite/scripts/common.sh around with_go to validate the downloaded gvm artifact before executing it (e.g., fail if content is HTML / missing expected header) so failures are explicit and faster to diagnose.
Investigation details

Root Cause

The trigger step executes .buildkite/scripts/trigger_integrations_in_parallel.sh, which calls with_mage and then with_go (.buildkite/scripts/trigger_integrations_in_parallel.sh, lines 7-10). In with_go, the script downloads gvm and immediately executes it:

  • .buildkite/scripts/common.sh:111 downloads gvm from GitHub Releases via curl
  • .buildkite/scripts/common.sh:113 executes gvm
  • .buildkite/scripts/common.sh:114 expects go version

In this run, the downloaded file was an HTML 504 page, causing shell parse errors and then go: command not found.

Evidence

/buildkite/.../bin/gvm: line 1: syntax error near unexpected token `<'
/buildkite/.../bin/gvm: line 1: `<html><body><h1>504 Gateway Time-out</h1>'
.buildkite/scripts/common.sh: line 114: go: command not found
  • Failed command: ./.buildkite/scripts/trigger_integrations_in_parallel.sh
  • Exit status: 127

Verification

  • Local repo script inspection confirms failure path through with_go in .buildkite/scripts/common.sh and trigger script call chain.

Follow-up

If this repeats frequently, consider adding curl --fail --retry-all-errors and content validation (or checksum/signature verification) before chmod +x/execution of downloaded tools.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@navnit-elastic navnit-elastic marked this pull request as ready for review June 8, 2026 09:38
@navnit-elastic navnit-elastic requested review from a team as code owners June 8, 2026 09:38
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jun 8, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 8, 2026

Copy link
Copy Markdown

✅ All changelog entries have the correct PR link.

@elasticmachine

elasticmachine commented Jun 8, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @navnit-elastic

@navnit-elastic navnit-elastic merged commit e579224 into elastic:main Jun 8, 2026
9 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 8, 2026

Copy link
Copy Markdown

Package ti_google_threat_intelligence - 0.12.2 containing this change is available at https://epr.elastic.co/package/ti_google_threat_intelligence/0.12.2/

@github-actions github-actions Bot mentioned this pull request Jun 8, 2026
Open
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

@brijesh-elastic brijesh-elastic brijesh-elastic approved these changes

Assignees

@navnit-elastic navnit-elastic

Labels

bugfix Pull request that fixes a bug issue Integration:ti_google_threat_intelligence Google Threat Intelligence (Partner supported) Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@navnit-elastic @elasticmachine @kcreddy @brijesh-elastic