[sentinel_one_cloud_funnel] Add Support for Azure Blob Storage Input

[mohitjha-elastic]

Proposed Commit Message

sentinel_one_cloud_funnel: add support for azure blob storage input.

Previously, azure blob storage input was not supported in the sentinel_one_cloud_funnel event data stream. 
This update adds support for azure blob storage input.

Testing has been performed using log samples available in the test folder, which were accessed via an
azure blob storage container to validate the input functionality.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

To test sentinel_one_cloud_funnel integration

Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/sentinel_one_cloud_funnel directory.
Run the following command to run tests.
elastic-package test -v

Related issues

• Closes [SentinelOne Cloud Funnel] Azure Blob Storage Input #13945

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

What testing has been done for this change?

[mohitjha-elastic]

What testing has been done for this change?

@efd6
System test is not possible in this case since one already exists for the REST API. Additionally, testing has been performed using log samples available in the test folder, which were accessed via an Azure Blob Storage container to validate the input functionality.

This has also been included in the commit message.

[ShourieG]

@mohitjha-elastic, let's attach a screen recording of the live testing with an actual blob storage for future context.

[mohitjha-elastic]

@ShourieG Please find the attached recording here:

s1-event-recording.mp4

[efd6]

@mohitjha-elastic Yes, I understand that testing can't be included in the package, but I'd like to know whether this was tested against a real endpoint.

I think this is answered by:

testing has been performed using log samples available in the test folder, which were accessed via an Azure Blob Storage container to validate the input functionality.

Am I interpreting that correctly? The video above suggests that I am.

[efd6]

LGTM, but I'd like a second from @ShourieG.

[ShourieG]

Hi @mohitjha-elastic, since we are adding fresh support for azure blob storage, lets also add the RBAC oauth2 config options introduced in this PR as an optional auth config. We need to keep min stack version of 8.16 for this.

[mohitjha-elastic]

@ShourieG
Added the RBAC oauth2 config options in the azure input.
Please find attached test recordings below:

Recording:
https://github.com/user-attachments/assets/1714a5be-a394-498e-a0e0-276b041db455

Screenshot:

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 176a958

History

• 💚 Build #27268 succeeded 9e11c3f
• 💚 Build #27265 succeeded 204aaea
• 💚 Build #26798 succeeded 910369d

cc @mohitjha-elastic

[ShourieG]

LGTM

[elastic-vault-github-plugin-prod]

Package sentinel_one_cloud_funnel - 1.13.0 containing this change is available at https://epr.elastic.co/package/sentinel_one_cloud_funnel/1.13.0/