[Prisma Cloud] Fix ingest pipeline processors with tags create_user_name_and_user_domain and convert_ip_address_to_ip that fails for some values

[leandrojmp]

Proposed commit message

This commits fix a dissect processor that uses the pattern %{user.name}@%{user.domain} on the field user.email, but the processor that creates the field user.email does not have a conditional to check if the value is indeed an email.

This also fix a convert processor the converts the field json.ipAddress into an IP Address, but this field sometimes is populate with a string value that makes reference to an internal IP Address used by Prisma Cloud.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Closes [Prisma Cloud]: A dissect and a convert processor are failing because of incompatible values. #12751

[efd6]

Please add tests for the behaviour.

These will do:

diff --git a/packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log b/packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log
index ed7b90bb7d..e6081ba1c3 100644
--- a/packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log
+++ b/packages/prisma_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log
@@ -1 +1,5 @@
-{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
\ No newline at end of file
+{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
+{"timestamp":1693819702240,"user":"john.user@google.com","ipAddress":"RedLock Internal IP","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
+{"timestamp":1693819702240,"user":"john.user@google.com","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
+{"timestamp":1693819702240,"user":"john.user","ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}
+{"timestamp":1693819702240,"ipAddress":"81.2.69.142","actionType":"LOGIN","resourceName":"john.user@google.com","action":"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.","resourceType":"Login","result":"fail"}

[leandrojmp]

@efd6 thanks!

just added the tests and made the suggested changes.

[efd6]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 0d59e69

[efd6]

Thanks

[elastic-vault-github-plugin-prod]

Package prisma_cloud - 2.0.1 containing this change is available at https://epr.elastic.co/package/prisma_cloud/2.0.1/