Fix pagination in 1Password Audit collection

[hellqvio86]

Pagnination does not work, elastic-agnet goes rampid and makes way to many requests against the 1password api. Pagination should be same as the other streams.

Proposed commit message

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• [-] I have added an entry to my package's changelog.yml file.
• [-] I have verified that Kibana version constraints are current according to guidelines.
• [-] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[cla-checker-service]

💚 CLA has been signed

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chemamartinez]

Change looks good to me! However, I think one more change is required in order to keep the system tests working.

Now that the has_more controls the pagination, in this mock response, has_more value should be true so the test makes the second request and ingest the two expected events.

[chemamartinez]

@hellqvio86 also the integration's version should be increased (to 1.33.1) and a changelog entry is required.

[chemamartinez]

Version needs to be updated in the package manifest as well.

[chemamartinez]

@hellqvio86 do you need some assistance for adding the requested changes? I've seen some activity since my last review but still missing some changes.

[hellqvio86]

@hellqvio86 do you need some assistance for adding the requested changes? I've seen some activity since my last review but still missing some changes.

I just updated the manifest is there anything else that I have missed? 🙂

[chemamartinez]

I just updated the manifest is there anything else that I have missed? 🙂

I don't see the change that I mentioned at #15407 (review).

[hellqvio86]

I just updated the manifest is there anything else that I have missed? 🙂

I don't see the change that I mentioned at #15407 (review).

has_more is true on line 107 in packages/1password/_dev/deployer/docker/config.yml

{"cursor":"cursor_0","has_more":true,"items":[{"uuid": "3UQOGUC7DVOCN4OZP2MDKHFLSG","timestamp": "2022-10-24T21:16:52.827288935Z","actor_uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4","action": "suspend","object_type": "user","object_uuid":"ZRQCUD6A65AKHFETOUFO7NL4OM","session":{"uuid": "ODOHXUYQCJBUJKRGZNNPBJURPE","login_time": "2022-10-24T21:07:34.703106271Z","device_uuid":"rqtd557fn2husnstp5nc66w2xa","ip":"89.160.20.156"},"location":{"country":"Canada","region": "Ontario","city": "Toronto","latitude": 43.64,"longitude": -79.433}}]}

[chemamartinez]

has_more is true on line 107 in packages/1password/_dev/deployer/docker/config.yml

Sorry, it's true. I didn't see the change in this PR anymore because last week they added the same change: #15415

It seems that the mentioned PR already fixes the pagination for the audit_events data stream so this one doesn't add anything new.

Do you mind to close it?