[Stack 8.16.0-SNAPSHOT] [cyberarkpas] Failing test daily: system test: tls in cyberarkpas.audit

[elastic-vault-github-plugin-prod[bot]]

• Stack version: 8.16.0-SNAPSHOT
• Package: cyberarkpas
• Failing test: system test: tls
• DataStream: audit
• Owners:
  • @elastic/security-service-integrations

Failure:

test case failed: could not find hits in logs-cyberarkpas.audit-16898 data stream

First build failed: https://buildkite.com/elastic/integrations/builds/14060

Latest 5 failed builds:

• https://buildkite.com/elastic/integrations/builds/15809
• https://buildkite.com/elastic/integrations/builds/15864
• https://buildkite.com/elastic/integrations/builds/15901
• https://buildkite.com/elastic/integrations/builds/15904
• https://buildkite.com/elastic/integrations/builds/15913

[efd6]

Looking at the set of failures in these, I see (mod the tenable_io issue, which is addressed by #10940) over a wide range of packages: no hits; changes in processor behaviour; missing field definitions — present in the definitions files; and failed CEL evaluations — in the case where the error is reported a 404. This looks very much to me like a global CI failure rather than a specific cyberarkpas failure.

All of the elastic-agent logs that are retained in the builders' stores have staled out, so to investigate this further we will need to see a new failure.