[Proofpoint TAP] Empty array response should not generate an event

[andrewkroh]

Each minute when there are no new events available, documents like this are indexed in Elasticsearch.

These are event.original values:

{"messagesDelivered:":[],"queryEndTime":"2023-05-23T19:01:34Z"}
{"messagesDelivered:":[],"queryEndTime":"2023-05-23T19:02:34Z"}

This was observed with the other data streams in the integration too.

References

• https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[andrewkroh]

FWIW this integration has a fairly short maximum look-back window and uses deduplication prevention, so IMO it is a candidate for CEL conversion because the risk of mass duplication on update is low.

[andrewkroh]

#9974 might be fixing this. @chrisberkhout, can you confirm?

[chrisberkhout]

#9974 might be fixing this. @chrisberkhout, can you confirm?

Correct