[BUG] Unable to modify detector

What is the bug?
Detectors can be created but not updated. A generic Kotlin error is displayed (see screenshot).

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Create detector.
2. Choose data source
3. Choose log type (it might be relevant to choose a custom log type)
4. Choose rule (also based on the custom log type)
5. Remove trigger (or not, does not seem to make any difference)
6. Create detector
7. Re-open/edit detector and click 'Save changes' (no changes necessary)

What is the expected behavior?
Detector config closes without error message, potential changes are applied.

What is your host/environment?

• OS: Ubuntu 22.04, Kubernetes
• Version: 2.12
• Plugins: Security Analytics

Do you have any screenshots?

Do you have any additional context?
This is related to Bug #955. In #955 I reported errors related to conflicts between index templates generated by the detector logic and already existing user generated index templates. This error occurs when there are no user generated index templates. The detector is trying to update the implicit document-level monitor which fails.

Log excerpt:

[2024-04-09T15:36:26,401][ERROR][o.o.a.u.AlertingException] [opensearch-nodes-2] Alerting error: java.lang.ClassCastException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap [2024-04-09T15:36:26,401][ERROR][o.o.a.u.AlertingException] [opensearch-nodes-2] Alerting error: AlertingException[kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap]; nested: Exception[java.lang.ClassCastException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap]; [2024-04-09T15:36:26,401][ERROR][o.o.s.t.TransportIndexDetectorAction] [opensearch-nodes-2] exception: org.opensearch.alerting.util.AlertingException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap at org.opensearch.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70) ~[?:?] at org.opensearch.alerting.transport.TransportIndexMonitorAction$IndexMonitorHandler.onGetResponse(TransportIndexMonitorAction.kt:716) ~[?:?] at org.opensearch.alerting.transport.TransportIndexMonitorAction$IndexMonitorHandler.access$onGetResponse(TransportIndexMonitorAction.kt:251) ~[?:?] at org.opensearch.alerting.transport.TransportIndexMonitorAction$IndexMonitorHandler$onGetResponse$1.invokeSuspend(TransportIndexMonitorAction.kt) ~[?:?] at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) ~[?:?] at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) ~[?:?] at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) ~[?:?] at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) ~[?:?] at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) ~[?:?] Caused by: java.lang.Exception: org.opensearch.alerting.util.AlertingException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap ... 9 more [2024-04-09T15:36:26,403][ERROR][o.o.s.u.SecurityAnalyticsException] [opensearch-nodes-2] Security Analytics error: org.opensearch.alerting.util.AlertingException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap at org.opensearch.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70) ~[?:?] at org.opensearch.alerting.transport.TransportIndexMonitorAction$IndexMonitorHandler.onGetResponse(TransportIndexMonitorAction.kt:716) ~[?:?] at org.opensearch.alerting.transport.TransportIndexMonitorAction$IndexMonitorHandler.access$onGetResponse(TransportIndexMonitorAction.kt:251) ~[?:?] at org.opensearch.alerting.transport.TransportIndexMonitorAction$IndexMonitorHandler$onGetResponse$1.invokeSuspend(TransportIndexMonitorAction.kt) ~[?:?] at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) ~[?:?] at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) ~[?:?] at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) ~[?:?] at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) ~[?:?] at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) ~[?:?] Caused by: java.lang.Exception: org.opensearch.alerting.util.AlertingException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap ... 9 more [2024-04-09T15:36:26,403][WARN ][r.suppressed ] [opensearch-nodes-2] path: /_plugins/_security_analytics/detectors/nqd2w44Bio0zWK-k-5zp, params: {detector_id=nqd2w44Bio0zWK-k-5zp} org.opensearch.securityanalytics.util.SecurityAnalyticsException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap at org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:68) ~[?:?] at org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:43) ~[?:?] at org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$AsyncIndexDetectorsAction.lambda$finishHim$0(TransportIndexDetectorAction.java:1537) ~[?:?] at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-2.12.0.jar:2.12.0] at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) ~[opensearch-2.12.0.jar:2.12.0] at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:913) [opensearch-2.12.0.jar:2.12.0] at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.12.0.jar:2.12.0] at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?] at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?] at java.base/java.lang.Thread.run(Thread.java:1583) [?:?] Caused by: java.lang.Exception: org.opensearch.alerting.util.AlertingException: kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap ... 10 more

Start with the detector update endpoint and the stack-trace locations in TransportIndexMonitorAction.kt:716 and TransportIndexDetectorAction. Reproduce the edit-and-save flow with a custom log type, then trace the implicit document-level monitor update. Done means an existing detector saves without the EmptyMap/MutableMap error and expected changes are applied.