{sentinel_one,m365_defender,ti_abusech,ti_anomali,trend_micro_vision_one}: Add script tests

[kcreddy]

Proposed commit message

Add script tests for 5 integrations

Add script tests covering auth failures, server errors, and recovery 
for all data streams in the following integrations:

sentinel_one (11 data streams)
- CEL (threat_event, unified_alert, application, application_risk):
  assert error events are indexed on 401/403; verify error.code and
  error.message before asserting recovery
- httpjson (threat, group, activity, agent): verify data collection
  recovers after 401/503 by asserting eventual document arrival

m365_defender (3 data streams)
- incident, alert (httpjson): assert recovery from 403 and 429 (with
  Retry-After header)
- vulnerability (CEL): assert error events indexed on 401 and 403
  during token and export API requests

ti_abusech (6 data streams)
- ja3_fingerprints, sslblacklist (GET, no auth): assert error event
  indexed on 503
- malwarebazaar, threatfox, url, malware (POST/GET with auth key):
  assert no documents collected when an invalid auth key is configured

ti_anomali (1 data stream)
- intelligence (CEL): assert error event indexed on invalid credentials

trend_micro_vision_one (6 data streams)
- alert, audit, detection (httpjson): assert recovery after 401
- endpoint_activity, network_activity (CEL): assert error event
  indexed on 401
- telemetry (CEL): assert error event indexed when
  GET /v3.0/datalake/dataPipelines returns 401 on first run

Note

No changelog is required as it doesn't have user impact.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Run elastic-package test script on each integration.
Sample output

--- Test results for package: m365_defender - START ---
╭───────────────┬─────────────┬───────────┬────────────────────┬────────┬─────────────────╮
│ PACKAGE       │ DATA STREAM │ TEST TYPE │ TEST NAME          │ RESULT │    TIME ELAPSED │
├───────────────┼─────────────┼───────────┼────────────────────┼────────┼─────────────────┤
│ m365_defender │ alert       │ script    │ env                │ PASS   │     72.919584ms │
│ m365_defender │ alert       │ script    │ forbidden_recovery │ PASS   │ 1m26.532725584s │
│ m365_defender │ alert       │ script    │ throttled_recovery │ PASS   │  1m3.089040958s │
╰───────────────┴─────────────┴───────────┴────────────────────┴────────┴─────────────────╯
--- Test results for package: m365_defender - END   ---
Done

Related issues

• Relates Integration Quality phase 1: Add script tests #17929

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: fc1b5a5

Failed CI Steps

• Check integrations ti_abusech
• Check integrations trend_micro_vision_one

History

cc @kcreddy

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Suggested change

	data_stream:
	vars:
	auth_key: test_auth_key
	data_stream:

[efd6]

Suggested change

	data_stream:
	vars:
	auth_key: test_auth_key
	data_stream:

[efd6]

Suggested change

	# Verify the error code matches the 401 response.
	exec jq -r '.hits.hits[0]._source.error.code' got_docs.json
	stdout '^401$'
	# Verify the error message indicates the 401 response.
	exec jq -r '.hits.hits[0]._source.error.message' got_docs.json
	stdout 'Unauthorized'

[efd6]

Suggested change

	# Verify the error code matches the 401 response.
	exec jq -r '.hits.hits[0]._source.error.code' got_docs.json
	stdout '^401$'
	# Verify the error message indicates the 401 response.
	exec jq -r '.hits.hits[0]._source.error.message' got_docs.json
	stdout 'Unauthorized'