rapid7-insightidr 1.13.1: accept an InsightIDR Essential key in test_connection

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/rapid7-insightidr/scripts/test_connection.py

@@ -1,4 +1,4 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import io, json, os, sys, urllib.request, urllib.parse, urllib.error
 
 
 def _cfg():
@@ -26,7 +26,19 @@ def request(method, path, params=None, body=None):
 
 
 def run():
-    request("GET", "idr/v1/investigations", params={"size": 1})
+    try:
+        request("GET", "idr/v1/investigations", params={"size": 1})
+    except urllib.error.HTTPError as e:
+        detail = e.read().decode("utf-8", "replace")
+        if e.code != 403 or "Essential" not in detail:
+            raise urllib.error.HTTPError(e.url, e.code, e.msg, e.hdrs, io.BytesIO(detail.encode("utf-8")))
+        # The Essential package has no Investigations or Alert Triage API, but
+        # Log Search answers: the key is good and LEQL feeds are the way in.
+        request("GET", "log_search/management/logsets")
+        print(json.dumps({"ok": True, "package": "essential",
+            "note": "InsightIDR Essential: investigation and alert commands are not available. "
+                    "Ingest detections with query_log_set, using each detection rule's LEQL query."}))
+        return
     print(json.dumps({"ok": True}))