[O365_Metrics] Add additional system tests

packages/o365_metrics/_dev/deploy/docker/files/ActiveUsersServicesUserCounts.csv

@@ -0,0 +1,6 @@
+Report Refresh Date,Exchange Active,Exchange Inactive,OneDrive Active,OneDrive Inactive,SharePoint Active,SharePoint Inactive,Skype For Business Active,Skype For Business Inactive,Yammer Active,Yammer Inactive,Teams Active,Teams Inactive,Office 365 Active,Office 365 Inactive,Report Period
+2025-06-01,0,15,0,15,0,15,,,0,20,0,18,0,20,7
+2025-06-02,1,14,0,14,1,14,,,0,19,1,17,1,19,7
+2025-06-03,2,13,1,13,1,13,,,0,18,2,16,2,18,7
+2025-06-04,2,12,1,12,2,12,,,1,17,2,15,3,17,7
+2025-06-05,3,11,2,11,3,11,,,1,16,3,14,4,16,7

packages/o365_metrics/_dev/deploy/docker/files/config.yml

@@ -1678,4 +1678,63 @@ rules:
           "error": {
           "code": "AuthenticationFailed",
           "message": "Authentication failed."
-          }
+          }
+  - path: /admin/serviceAnnouncement/healthOverviews/Microsoft 365 suite
+    methods: ["GET"]
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - "application/json"
+        body: |-
+          {
+          "service":"Microsoft 365 suite",
+          "status":"serviceDegradation",
+          "id":"OSDPPlatform"
+          }
+      - status_code: 401
+        headers:
+          Content-Type:
+            - "application/json"
+        body: |-
+          {
+              "error": {
+                  "code": "InvalidAuthenticationToken",
+                  "message": "IDX14102: Unable to decode the header '[PII of type 'Microsoft.IdentityModel.Logging.SecurityArtifact' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]' as Base64Url encoded string.",
+                  "innerError": {
+                      "date": "2025-06-19T21:49:34",
+                      "request-id": "a3768fc9-3dcd-447b-ba14-0b090e226146",
+                      "client-request-id": "a3768fc9-3dcd-447b-ba14-0b090e226146"
+                  }
+              }
+          }
+      - status_code: 400
+        headers:
+          Content-Type:
+            - 'applciation/json'
+        body: |-
+          {
+              "error": {
+                  "code": "InvalidAuthenticationToken",
+                  "message": "Lifetime validation failed, the token is expired.",
+                  "innerError": {
+                      "date": "2025-03-25T14:33:19",
+                      "request-id": "61d323d8-abba-4f69-8ab5-660e86160ec4",
+                      "client-request-id": "61d323d8-abba-4f69-8ab5-660e86160ec4"
+                  }
+              }
+          }
+  - path: /reports/getOffice365ServicesUserCounts
+    methods: ["GET"]
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - "application/octet-stream"
+        body: '{{file "/files/ActiveUsersServicesUserCounts.csv"}}'

packages/o365_metrics/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.16.0"
+  changes:
+    - description: Add system tests for "service_health" data stream.
+      type: enhancement
+      link: TBD
 - version: "0.15.0"
   changes:
     - description: Add dashboard for `subscriptions` data stream.

packages/o365_metrics/data_stream/active_users_services_user_counts/_dev/test/system/test-default-config.yml

@@ -0,0 +1,14 @@
+input: cel
+service: o365_metrics
+vars:
+  url: http://{{Hostname}}:{{Port}}
+  token_url: http://{{Hostname}}:{{Port}}
+  azure_tenant_id: "1234"
+  client_id: "1234"
+  client_secret: "1234"
+data_stream:
+  vars:
+    interval: 30s
+    preserve_original_event: true
+assert:
+  hit_count: 5

packages/o365_metrics/data_stream/service_health/_dev/test/system/test-common-config.yml

@@ -0,0 +1,17 @@
+input: cel
+service: o365_metrics
+vars:
+  url: http://{{Hostname}}:{{Port}}
+  token_url: http://{{Hostname}}:{{Port}}
+  azure_tenant_id: "1234"
+  client_id: "1234"
+  client_secret: "1234"
+data_stream:
+  vars:
+    interval: 30s
+assert:
+  hit_count: 1
+  fields_present:
+    - o365.metrics.service.health.status
+    - o365.metrics.service.health.id
+    - o365.metrics.service.health.service

packages/o365_metrics/data_stream/service_health/fields/base-fields.yml

@@ -10,3 +10,6 @@
 - name: '@timestamp'
   type: date
   description: Event timestamp.
+- name: input.type
+  type: keyword
+  description: Input type.

packages/o365_metrics/docs/README.md

@@ -2429,6 +2429,7 @@ Please refer to the following [document](https://www.elastic.co/guide/en/ecs/cur
 | host.containerized | If the host is a container. | boolean |
 | host.os.build | OS build information. | keyword |
 | host.os.codename | OS codename, if any. | keyword |
+| input.type | Input type. | keyword |
 | o365.metrics.service.health.id | The service id. | keyword |
 | o365.metrics.service.health.service | The service name. | keyword |
 | o365.metrics.service.health.status | Show the overall service health status (Eg. serviceOperational, serviceOperational etc.). | keyword |
@@ -2574,6 +2575,7 @@ An example event for `subscriptions` looks as following:
         "o365.metrics.subscriptions"
     ]
 }
+
 ```
 
 **ECS Field Reference**
@@ -2910,6 +2912,7 @@ An example event for `teams_call_quality` looks as following:
         "o365.metrics.teams.call.quality"
     ]
 }
+
 ```
 
 **ECS Field Reference**
@@ -3200,6 +3203,7 @@ An example event for `app_registrations` looks as following:
         "o365.metrics.app_registrations"
     ]
 }
+
 ```
 
 **ECS Field Reference**
@@ -3319,6 +3323,7 @@ An example event for `entra_features` looks as following:
         "o365.metrics.entra_features"
     ]
 }
+
 ```
 
 Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields.
@@ -3447,6 +3452,7 @@ An example event for `entra_agent` looks as following:
         "o365.metrics.entra_agent"
     ]
 }
+
 ```
 
 Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields.
@@ -3570,6 +3576,7 @@ An example event for `entra_alerts` looks as following:
         "o365.metrics.entra_alerts"
     ]
 }
+
 ```
 
 Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields.

packages/o365_metrics/manifest.yml

@@ -1,6 +1,6 @@
 name: o365_metrics
 title: Microsoft Office 365 Metrics
-version: "0.15.0"
+version: "0.16.0"
 description: Collect metrics from Microsoft Office 365 with Elastic Agent.
 type: integration
 format_version: "3.0.2"