snyk: fix audit_logs event type filter being silently ignored

[kcreddy]

Proposed commit message

snyk: fix audit_logs event type filter

The Handlebars template stores the user's event filter config as
state.event_filter, but the CEL program read state.events_filter
(note the extra 's'). The optional field access returned none,
so the "events" query parameter was never included in the API
request, so event filtering was silently ignored.

Additionally, format_query() on a list produces repeated keys
(events=a&events=b). The Snyk API documents the parameter as a
comma-separated list, so the fix joins the list into a single
value (events=a,b).

Snyk's OpenAPI spec names the parameter "event" (singular), but
live testing confirms the API only honours "events" (plural) —
"event" is silently ignored. The migration guide also documents
the plural form:
https://docs.snyk.io/snyk-api/api-end-of-life-eol-process-and-migration-guides/guides-to-migration/search-audit-logs-group-and-org-v1-api-to-ga-rest-audit-logs-api-migration-guide

Tested against a live Snyk org endpoint with mito, confirming
the filter now correctly narrows results.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Newly added system tests (with event option) passes:

--- Test results for package: snyk - START ---
╭─────────┬─────────────┬───────────┬──────────────┬────────┬───────────────╮
│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME    │ RESULT │  TIME ELAPSED │
├─────────┼─────────────┼───────────┼──────────────┼────────┼───────────────┤
│ snyk    │ audit_logs  │ system    │ event-filter │ PASS   │ 46.624782375s │
╰─────────┴─────────────┴───────────┴──────────────┴────────┴───────────────╯
--- Test results for package: snyk - END   ---
Done

Related issues

• Closes [bug-hunter] Snyk audit_logs event filter is ignored due to state key mismatch #18653
• Closes snyk: fix audit_logs event type filter #18929

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Can you take the change from here? You have a test which I don't so let's use your PR. You can grab text from the commit message if you want.

(I did not see that you had sent this.)

[kcreddy]

Done in 26e7f64 and updated commit message accordingly. Thanks!

[efd6]

Thanks

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 26e7f64

History

• 💚 Build #42582 succeeded 83a1fdf

cc @kcreddy

[elastic-vault-github-plugin-prod]

Package snyk - 3.4.3 containing this change is available at https://epr.elastic.co/package/snyk/3.4.3/