Add testcase to check for related_integrations based on index (#4096)

(cherry picked from commit 275c728)

Author: shashank-elastic

detection_rules/schemas/definitions.py

@@ -247,3 +247,11 @@ def validator(value):
     'geo_point', 'geo_shape', 'point', 'shape',
     'percolator'
 ]
+
+# definitions for the integration to index mapping unit test case
+IGNORE_IDS = ["eb079c62-4481-4d6e-9643-3ca499df7aaa", "699e9fdb-b77c-4c01-995c-1c15019b9c43",
+              "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0", "a198fbbd-9413-45ec-a269-47ae4ccf59ce",
+              "0c41e478-5263-4c69-8f9e-7dfd2c22da64", "aab184d3-72b3-4639-b242-6597c99d8bca",
+              "a61809f3-fb5b-465c-8bff-23a8a068ac60", "f3e22c8b-ea47-45d1-b502-b57b6de950b3"]
+IGNORE_INDICES = ['.alerts-security.*', 'logs-*', 'metrics-*', 'traces-*', 'endgame-*',
+                  'filebeat-*', 'packetbeat-*', 'auditbeat-*', 'winlogbeat-*']

rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2022/09/03"
-integration = ["endpoint"]
+integration = ["endpoint", "auditd_manager"]
 maturity = "production"
-updated_date = "2024/09/10"
+updated_date = "2024/09/23"
 
 [rule]
 author = ["Elastic"]

rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2023/04/03"
-integration = ["endpoint", "windows"]
+integration = ["endpoint", "windows", "system"]
 maturity = "production"
-updated_date = "2024/08/07"
+updated_date = "2024/09/23"
 
 [rule]
 author = ["Elastic"]

rules/windows/command_and_control_rdp_tunnel_plink.toml

@@ -1,10 +1,10 @@
 [metadata]
 creation_date = "2020/10/14"
-integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
+integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
 maturity = "production"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 min_stack_version = "8.14.0"
-updated_date = "2024/10/15"
+updated_date = "2024/10/17"
 
 [rule]
 author = ["Elastic"]

rules/windows/command_and_control_screenconnect_childproc.toml

@@ -1,10 +1,10 @@
 [metadata]
 creation_date = "2024/03/27"
-integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
+integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
 maturity = "production"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 min_stack_version = "8.14.0"
-updated_date = "2024/10/15"
+updated_date = "2024/10/17"
 
 [rule]
 author = ["Elastic"]

rules/windows/command_and_control_tunnel_vscode.toml

@@ -1,10 +1,10 @@
 [metadata]
 creation_date = "2024/09/09"
-integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
+integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system"]
 maturity = "production"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 min_stack_version = "8.14.0"
-updated_date = "2024/10/15"
+updated_date = "2024/10/17"
 
 [rule]
 author = ["Elastic"]

rules/windows/credential_access_cmdline_dump_tool.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/11/24"
-integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
+integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
 maturity = "production"
-updated_date = "2024/10/15"
+updated_date = "2024/10/17"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 

rules/windows/credential_access_dcsync_newterm_subjectuser.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2022/12/19"
-integration = ["windows"]
+integration = ["windows", "system"]
 maturity = "production"
-updated_date = "2024/08/07"
+updated_date = "2024/09/23"
 
 [rule]
 author = ["Elastic"]

rules/windows/credential_access_persistence_network_logon_provider_modification.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2021/03/18"
-integration = ["endpoint", "m365_defender"]
+integration = ["endpoint", "m365_defender", "windows"]
 maturity = "production"
-updated_date = "2024/10/15"
+updated_date = "2024/10/17"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 

rules/windows/credential_access_saved_creds_vaultcmd.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2021/01/19"
-integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
+integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
 maturity = "production"
-updated_date = "2024/10/15"
+updated_date = "2024/10/17"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."