[o365] Stricter enforcement of maximum age limits

[chrisberkhout]

Proposed commit message

[o365] Stricter enforcement of maximum age limits

In order to avoid requesting data more than 7 days old:

- When calculating the start of the allowed time range, use `now()` (a
  function that returns the current time) rather than `now` (which is
  the time the current CEL evaluation began), as the latter will become
  too old if a singe CEL evaluation runs for more than a few minutes.

- Make the `167h55m`  limit used throughout the CEL expression
  configurable, in the advanced settings, so that it can be shortened if
  necessary.

This integration's CEL expression is one that may run for a long time.
For each of a list of content types it will register a subscription,
list data and fetch data, and this has been observed to take many
minutes.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package o365 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
audit	1672.24	1010.1	-662.14 (-39.6%)	💔

To see the full report comment with /test benchmark fullreport

[efd6]

nits only

[efd6]

Thanks

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e669b33

History

• 💚 Build #28646 succeeded 644be53

cc @chrisberkhout

[elastic-vault-github-plugin-prod]

Package o365 - 2.18.6 containing this change is available at https://epr.elastic.co/package/o365/2.18.6/