FireEye ETP - Fix missing alert details and event data in Email Alerts Connector for v2 API

[adarshtwy]

Overview

This PR fixes an issue where the FireEye ETP integration fails to ingest alert details and event data in the Email Alerts Connector when communicating with the v2 API (Bug b/543804375).

Key Changes

• FireEyeETPManager.get_alert_details: Fixed response JSON parsing to handle root dictionary responses when "data" wrapper is absent in v2 detail API responses.
• Alert Datamodel: Upgraded Alert model to parse nested v2 schema (alert, email-header, smtp-message, explanation/malware-detected, src, dst), generate malware and recipient events, and compute accurate numerical priorities.
• Utils Manager: Made timezone offset parsing resilient against None and added support for 14-digit compact timestamp strings (YYYYMMDDhhmmss).
• Connector: Added compatibility for Arrow timestamp callable/property and safe alert sorting in create_alert_info.
• Ontology Mappings: Updated field and entity mapping rules for v2 flattened event paths.
• Typing Modernization: Replaced dict[str, Any] annotations with SingleJson from TIPCommon.types.
• Packaging & Tests: Bumped integration version to 11.0, updated release_notes.yaml and uv.lock, and added unit tests for all 7 customer sample alert payloads.

BUG=b/543804375

[github-actions]

❌ Integration Tests Failed

Click to view the full report

---

🧩 fire_eye_etp

✅ Passed	❌ Failed	⏭️ Skipped
3	1	0

❌ Failed Tests

tests/test_v2_parsing.py::test_sample_alerts_parsing

def test_sample_alerts_parsing() -> None:
        """Verify that all sample alert.json files parse correctly into Alert objects."""
        base_dir = Path("/tmp/fireeye_analysis/sample_alerts")  # noqa: S108
        sample_files = list(base_dir.glob("*/alert.json"))
>       assert len(sample_files) > 0, "Should have sample alert files extracted"
E       AssertionError: Should have sample alert files extracted
E       assert 0 > 0
E        +  where 0 = len([])

tests/test_v2_parsing.py:34: AssertionError

[github-actions]

❌ Integration Tests Failed

Click to view the full report

---

🧩 fire_eye_etp

✅ Passed	❌ Failed	⏭️ Skipped
3	1	0

❌ Failed Tests

tests/test_v2_parsing.py::test_sample_alerts_parsing

def test_sample_alerts_parsing() -> None:
        """Verify that all sample alert.json files parse correctly into Alert objects."""
        base_dir = Path("/tmp/fireeye_analysis/sample_alerts")  # noqa: S108
        sample_files = list(base_dir.glob("*/alert.json"))
>       assert len(sample_files) > 0, "Should have sample alert files extracted"
E       AssertionError: Should have sample alert files extracted
E       assert 0 > 0
E        +  where 0 = len([])

tests/test_v2_parsing.py:34: AssertionError

[github-actions]

❌ Integration Tests Failed

Click to view the full report

---

🧩 fire_eye_etp

✅ Passed	❌ Failed	⏭️ Skipped
3	1	0

❌ Failed Tests

tests/test_v2_parsing.py::test_sample_alerts_parsing

def test_sample_alerts_parsing() -> None:
        """Verify that all sample alert.json files parse correctly into Alert objects."""
        base_dir = Path("/tmp/fireeye_analysis/sample_alerts")  # noqa: S108
        sample_files = list(base_dir.glob("*/alert.json"))
>       assert len(sample_files) > 0, "Should have sample alert files extracted"
E       AssertionError: Should have sample alert files extracted
E       assert 0 > 0
E        +  where 0 = len([])

tests/test_v2_parsing.py:34: AssertionError