sentinel_one: do not log empty template as DEGRADED health (elastic#15993)

Author: efd6

packages/sentinel_one/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.43.1"
+  changes:
+    - description: Do not log expected empty template results as DEGRADED health in activity, alert or threat data streams.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/15993
 - version: "1.43.0"
   changes:
     - description: Add support for threat event data stream.

packages/sentinel_one/data_stream/activity/_dev/test/policy/test-all.expected

@@ -9,6 +9,7 @@ inputs:
         - config_version: 2
           cursor:
             last_create_at:
+                do_not_log_failure: true
                 ignore_empty_value: true
                 value: '[[.last_event.createdAt]]'
           data_stream:
@@ -134,6 +135,7 @@ inputs:
           request.url: http://host.tld/web/api/v2.1/activities
           response.pagination:
             - set:
+                do_not_log_failure: true
                 fail_on_template_error: true
                 target: url.params.cursor
                 value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'

packages/sentinel_one/data_stream/activity/_dev/test/policy/test-default.expected

@@ -9,6 +9,7 @@ inputs:
         - config_version: 2
           cursor:
             last_create_at:
+                do_not_log_failure: true
                 ignore_empty_value: true
                 value: '[[.last_event.createdAt]]'
           data_stream:
@@ -41,6 +42,7 @@ inputs:
           request.url: http://host.tld/web/api/v2.1/activities
           response.pagination:
             - set:
+                do_not_log_failure: true
                 fail_on_template_error: true
                 target: url.params.cursor
                 value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'

packages/sentinel_one/data_stream/activity/agent/stream/httpjson.yml.hbs

@@ -39,10 +39,12 @@ response.pagination:
       target: url.params.cursor
       value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'
       fail_on_template_error: true
+      do_not_log_failure: true
 cursor:
   last_create_at:
     value: '[[.last_event.createdAt]]'
     ignore_empty_value: true
+    do_not_log_failure: true
 response.split:
   target: body.data
   ignore_empty_value: true

packages/sentinel_one/data_stream/alert/_dev/test/policy/test-all.expected

@@ -9,6 +9,7 @@ inputs:
         - config_version: 2
           cursor:
             last_create_at:
+                do_not_log_failure: true
                 ignore_empty_value: true
                 value: '[[.last_event.alertInfo.createdAt]]'
           data_stream:
@@ -134,6 +135,7 @@ inputs:
           request.url: http://host.tld/web/api/v2.1/cloud-detection/alerts
           response.pagination:
             - set:
+                do_not_log_failure: true
                 fail_on_template_error: true
                 target: url.params.cursor
                 value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'

packages/sentinel_one/data_stream/alert/_dev/test/policy/test-default.expected

@@ -9,6 +9,7 @@ inputs:
         - config_version: 2
           cursor:
             last_create_at:
+                do_not_log_failure: true
                 ignore_empty_value: true
                 value: '[[.last_event.alertInfo.createdAt]]'
           data_stream:
@@ -41,6 +42,7 @@ inputs:
           request.url: http://host.tld/web/api/v2.1/cloud-detection/alerts
           response.pagination:
             - set:
+                do_not_log_failure: true
                 fail_on_template_error: true
                 target: url.params.cursor
                 value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'

packages/sentinel_one/data_stream/alert/agent/stream/httpjson.yml.hbs

@@ -39,10 +39,12 @@ response.pagination:
       target: url.params.cursor
       value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'
       fail_on_template_error: true
+      do_not_log_failure: true
 cursor:
   last_create_at:
     value: '[[.last_event.alertInfo.createdAt]]'
     ignore_empty_value: true
+    do_not_log_failure: true
 response.split:
   target: body.data
   ignore_empty_value: true

packages/sentinel_one/data_stream/threat/_dev/test/policy/test-all.expected

@@ -9,6 +9,7 @@ inputs:
         - config_version: 2
           cursor:
             last_update_at:
+                do_not_log_failure: true
                 ignore_empty_value: true
                 value: '[[.last_event.threatInfo.updatedAt]]'
           data_stream:
@@ -134,6 +135,7 @@ inputs:
           request.url: http://host.tld/web/api/v2.1/threats
           response.pagination:
             - set:
+                do_not_log_failure: true
                 fail_on_template_error: true
                 target: url.params.cursor
                 value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'

packages/sentinel_one/data_stream/threat/_dev/test/policy/test-default.expected

@@ -9,6 +9,7 @@ inputs:
         - config_version: 2
           cursor:
             last_update_at:
+                do_not_log_failure: true
                 ignore_empty_value: true
                 value: '[[.last_event.threatInfo.updatedAt]]'
           data_stream:
@@ -41,6 +42,7 @@ inputs:
           request.url: http://host.tld/web/api/v2.1/threats
           response.pagination:
             - set:
+                do_not_log_failure: true
                 fail_on_template_error: true
                 target: url.params.cursor
                 value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'

packages/sentinel_one/data_stream/threat/agent/stream/httpjson.yml.hbs

@@ -39,10 +39,12 @@ response.pagination:
       target: url.params.cursor
       value: '[[if (ne .last_response.body.pagination.nextCursor nil)]][[.last_response.body.pagination.nextCursor]][[end]]'
       fail_on_template_error: true
+      do_not_log_failure: true
 cursor:
   last_update_at:
     value: '[[.last_event.threatInfo.updatedAt]]'
     ignore_empty_value: true
+    do_not_log_failure: true
 response.split:
   target: body.data
   ignore_empty_value: true