fix: Prevent NPE in OSQueryBackend when fieldMappings is null

[nagendramohan]

When creating a detector for a Sigma rule with an aggregation expression, ruleFieldMappings.get(category) can return null if the log type has no field mappings defined. This null was passed directly to the OSQueryBackend constructor, which stored it as-is when enableFieldMappings=true. Subsequent calls to getMappedField() then threw NullPointerException on this.fieldMappings.containsKey(field).

Fix: Initialize fieldMappings to an empty HashMap when the provided map is null (in QueryBackend constructor). Also adds a null guard in getMappedField() as defense-in-depth.

When fieldMappings is empty/null, fields pass through unmapped — the aggregation query uses the original Sigma field names, which is the correct degraded behavior.

Resolves #1750

Description

When creating a detector for a Sigma rule with an aggregation expression (e.g., count(field) > N), ruleFieldMappings.get(category) returns null if the log type has no field mappings defined. This null was passed to OSQueryBackend, causing a NullPointerException at this.fieldMappings.containsKey(field) in getMappedField().

Fix: Initialize fieldMappings to an empty HashMap when the provided map is null (in QueryBackend constructor). Also adds a null guard in getMappedField() as defense-in-depth. When mappings are unavailable, fields pass through unmapped — the correct degraded behavior.

Related Issues

Resolves #1750

Testing

• Added testBackendWithNullFieldMappingsAndEnableFieldMappingsTrue — verifies rules convert without NPE
• Added testBackendAggregationWithNullFieldMappings — verifies aggregation rules work with null mappings
• Full QueryBackendTests suite (51 tests) passes

Check List

• New functionality includes testing.
• New functionality has been documented.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 PR contains tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[nagendramohan]

Gentle bump 🙂 — small fix + tests for the NPE in QueryBackend/getMappedField when an aggregation detector has enableFieldMappings=true but fieldMappings is null (#1750). Would appreciate a maintainer review when there's bandwidth; happy to iterate on feedback. Thanks!