[O365] Check contentExpiration timestamp before requesting contents

[kcreddy]

Proposed commit message

• Check contentExpiration timestamp before requesting contents.
  • Add system tests to verify this scenario
• Remove outermost reference to now as the minimum kibana.version is already updated to 8.12
• Avoid state's timestamp being stuck with older than 7 days by checking it against (now - duration("167h55m"))

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

elastic-package stack down && elastic-package build && elastic-package stack up -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test system --generate -v

--- Test results for package: o365 - START ---
╭─────────┬─────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├─────────┼─────────────┼───────────┼───────────┼────────┼───────────────┤
│ o365    │ audit       │ system    │ cel       │ PASS   │ 39.764056792s │
╰─────────┴─────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: o365 - END   ---
Done

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

Indent this block one level.

[kcreddy]

indented the block

[efd6]

Indent this block one level.

[kcreddy]

indented the block

[efd6]

Since we are now on 8.12.

Suggested change

	"next_page": (
	(has(list_contents_resp.Header) && has(list_contents_resp.Header.NextPageUri) ) ?
	list_contents_resp.Header.NextPageUri[0]
	: (has(list_contents_resp.Header) && has(list_contents_resp.Header.Nextpageuri)) ?
	list_contents_resp.Header.Nextpageuri[0]
	:
	""
	"next_page": list_contents_resp.?Header.NextPageUri.orValue(list_contents_resp.?Header.Nextpageuri).orValue(""),

(we can probably get nice cleanup throughout by using these, but lets do that in another PR, rather than in a bugfix)

[kcreddy]

Agreed. I was thinking of the same in another PR.

[efd6]

See comment below for use of optional types.

[kcreddy]

Will do the optional types conversion in another PR 👍🏼

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 8c3904b

History

• 💚 Build #9987 succeeded 2f023ed

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[elasticmachine]

Package o365 - 2.3.1 containing this change is available at https://epr.elastic.co/search?package=o365