[Cybereason] Add system test coverage

[moxarth-rathod]

Proposed commit message

cybereason: add system tests and increase base64 icon field limits to 4096

Add system tests for all data streams.

Also address field indexing issues identified by the new tests where
base64-encoded icons were being ignored due to insufficient field
length limits. The limits are increased from the default to 4096
characters for icon-related fields in suspicions_process and
malop_process data streams.

Test logs were generated from existing pipeline test logs.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Relates [SSI - System test] Improve system test coverage for the SSI integrations #15144

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package cybereason 👍(2) 💚(2) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
malop_process	805.15	451.06	-354.09 (-43.98%)	💔
malware	10526.32	8000	-2526.32 (-24%)	💔

To see the full report comment with /test benchmark fullreport

[efd6]

Please fix the commit message. At the moment it does not make any comment on the test addition. The work here is more complex than the proposed commit message would suggest. There are new test samples in the docker config, so the origin of these should be described in the commit message.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: eb37304

History

• 💚 Build #36718 succeeded 9005cbf

cc @moxarth-rathod

[efd6]

Suggest:

cybereason: add system tests and increase base64 icon field limits to 4096

Add system tests for all data streams.

Also address field indexing issues identified by the new tests where
base64-encoded icons were being ignored due to insufficient field
length limits. The limits are increased from the default to 4096
characters for icon-related fields in suspicions_process and
malop_process data streams.

Test logs were generated from existing pipeline test logs.

[efd6]

Can I confirm that where we have assert.hit_count: 1 you have made this choice because the agent is not paginating?

[moxarth-rathod]

Yes, only the malware data stream has pagination.