[Security Solution][Detections] Indicator match rule mappings are not validated during creation

[MadameSheema]

Describe the bug:

• In the threatintel module, the domain indicator, is mapped as keyword. However, some of the values represented are IPs. If you want to match your ingested data that contains IPs with the domain indicator, the execution of the rule will fail.

Kibana/Elasticsearch Stack version:

• 7.12.0

Preconditions:

• To have the threatintel module activated
• To have ingested in an doc an IP that matches with one of the listed indicator domains:
  • Mapping

 {
   "properties":{
      "@timestamp":{
         "type":"date"
      },
      "destination":{
         "properties":{
            "ip":{
               "type":"ip"
            }
         }
      }
   }
} 

• Data

{
     "@timestamp":"2021-02-22T21:00:49.337Z",
      "destination":{
            "ip": "117.242.211.13"
         }
}

Steps to reproduce:

1. Create an indicator match rule with the following details:

• Index patterns: the name of the index where you created the example doc
• Custom query: *:*
• Indicator index patterns: file*
• Indicator mapping: destination.ip MATCHES threatintel.indicator.domain
• Indicator index query: *:*
• Runs every: 10s
• Additional look-back time: 300000h

2. Wait for the rule to be exectuted

Current behavior:

Expected behavior:

• No error is displayed
• Alerts are generated

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[MadameSheema]

Found during 7.12.0 BC3 testing: #93589