feat(cli): add 'Expected Behavior' alert close reason (#1380)

* feat(cli): add 'Expected Behaviour' alert close reason

Signed-off-by: Darren Murray <[email protected]>

* fix: typo

Signed-off-by: Darren Murray <[email protected]>

* test: update help tests

Signed-off-by: Darren Murray <[email protected]>

---------

Signed-off-by: Darren Murray <[email protected]>

Author: dmurray-lacework

api/alerts_close.go

@@ -30,6 +30,7 @@ const (
 	AlertCloseReasonNotEnoughInfo
 	AlertCloseReasonMalicious
 	AlertCloseReasonExpected
+	AlertCloseReasonExpectedBehavior
 )
 
 // String returns the string representation of an Alert closure reason
@@ -41,11 +42,12 @@ type alertCloseReasons map[alertCloseReason]string
 
 // AlertCloseReasons is the list of available Alert closure reasons
 var AlertCloseReasons = alertCloseReasons{
-	AlertCloseReasonOther:         "Other",
-	AlertCloseReasonFalsePositive: "False positive",
-	AlertCloseReasonNotEnoughInfo: "Not enough information",
-	AlertCloseReasonMalicious:     "Malicious and have resolution in place",
-	AlertCloseReasonExpected:      "Expected because of routine testing",
+	AlertCloseReasonOther:            "Other",
+	AlertCloseReasonFalsePositive:    "False positive",
+	AlertCloseReasonNotEnoughInfo:    "Not enough information",
+	AlertCloseReasonMalicious:        "Malicious and have resolution in place",
+	AlertCloseReasonExpected:         "Expected because of routine testing",
+	AlertCloseReasonExpectedBehavior: "Expected Behavior",
 }
 
 func (acr alertCloseReasons) GetOrderedReasonStrings() []string {

cli/docs/lacework_alert_close.md

@@ -19,6 +19,7 @@ The reason for closing the alert must be provided from the following options:
   * 2 - Not enough information
   * 3 - Malicious and have resolution in place
   * 4 - Expected because of routine testing.
+  * 5 - Expected Behavior.
 
 Reasons may be provided inline or via prompt.