[ti_opencti] Fix service DLL handling and other minor pipeline issues

[chrisberkhout]

Proposed commit message

[ti_opencti] Fix service DLL handling and other minor pipeline issues

The original service DLL handling had two broken renames:
- To `_ingest.node._value.additional_names` rather than
  `_ingest._value....` (from the foreach processor).
- From `_ingest._value.node` to `_ingest._value`, which failed because
  the target exists.

It also produced `service_dlls`, while the mappings and downstream
processors expect `service_dll`. It's fixed and simplified by replacing
the four nested foreach processors with a single Painless script that
unwraps each `serviceDlls.edges[].node` into `service_dll` and renames
the OpenCTI-specific fields at the same time.

Invalid `?.` syntax is removed from Mustache templates (it's for
Painless, not Mustache).

The `threat.indicator.file.size` value is set with `copy_from` rather
than a template to avoid unnecessary stringification.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[chrisberkhout]

All Vera issues resolved.

[vera-review-bot]

Review summary

Issues found across the latest commits 97d4c3f, 1d00510 — 2 low

• 🔵 The new expected output shows threat.indicator.file.extension as ["dll", "dll"] because the extension script in ecs_from_file.yml never de-duplicates (link) (Unresolved)
• 🔵 The new service DLL script processor has no tag, so the pipeline on_failure handler reports an empty processor tag if it throws (link) (Unresolved)

Issues found across earlier commits e8768ca — 4 medium, 2 low

• 🟡 All three new changelog entries link to placeholder PR Initial structure #1 instead of this PR (20569) - update the three link values before merge. (link) (Resolved)
• 🔵 Changelog description reads "in a Mustache templates" - drop the stray article so it reads "in Mustache templates". (link) (Resolved)
• 🔵 service_dll is now emitted as an array of objects under an object-mapped group, so per-DLL name/hash/size correlation is lost when a process has more than one service DLL (link) (Resolved)
• 🟡 Changelog links a different PR number (link) (Resolved)
• 🟡 Changelog links a different PR number (link) (Resolved)
• 🟡 Changelog links a different PR number (link) (Resolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 1d00510

History

• 💔 Build #47335 failed e8768ca

cc @chrisberkhout

[chrisberkhout]

Vera comments resolved again.