[Microsoft Exchange Online Message Trace] Use case-insensitive comparison for mailflow direction calculation

[moxarth-rathod]

Proposed commit message

  microsoft_exchange_online_message_trace: Use case-insensitive comparison for mailflow direction calculation

  This change updates the mailflow direction script to compare source.domain and
  destination.domain against configured local domains case-insensitively using
  equalsIgnoreCase. Microsoft Graph can return sender and recipient domains in mixed
  case , so a case-sensitive match previously misclassifies
  internal mail as external.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

• Closes [Microsoft Exchange Online Message Trace]: Lowercase source.domain and destination.domain #19375

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

No issues across the latest commits 1006d75.

I'll pick up this PR for review again after 15 minutes.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 1006d75

cc @moxarth-rathod

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package microsoft_exchange_online_message_trace - 2.2.4 containing this change is available at https://epr.elastic.co/package/microsoft_exchange_online_message_trace/2.2.4/