fix(rapid7-insightidr): a partial region result is not a quiet period (v1.6.0)

An RRN states its region — rrn:alerts:eu:<org>:alert:… — while the base URL is
built from the instance's configured `region`. Following that thread found a
gap that matters more than the naming.

The Alert Triage API is multi-region behind one gateway, and eleven of its
endpoints can answer HTTP 200 with a region_failures list. The spec is explicit:
the presence of items in that field IS the partial failure. Three of the
commands here call such endpoints and all three read only the payload, so a
region the gateway could not reach produced fewer alerts and nothing else — no
error, no count, no log line. For an ingestion feed that is indistinguishable
from a quiet period, which is the one failure mode this integration has now hit
three separate times.

So region_failures is carried into the run metadata by every command that can
receive it, alongside the regions actually seen in the collected RRNs, the
configured region, and any mismatch between them.

The mismatch report is deliberately a report and not a correction. On a
single-region tenant the two always agree. On a multi-customer key, which spans
organizations, they need not — and rewriting the host per resource would be a
guess about how Rapid7 routes these calls, made without a tenant to verify it
against. Naming the discrepancy is what can be done honestly today; if it ever
fires, the metadata says so instead of the alerts silently going missing.

list_alert_fields already passed region_failures through untouched, since it
returns the API response as it stands.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/rapid7-insightidr/scripts/search_alerts.py

@@ -79,6 +79,32 @@ def _terms(inp):
     return [{"field_ids": field_ids, "operator": op, "terms": values}]
 
 
+def _rrn_region(rrn):
+    """The region segment of an RRN, or None.
+
+    An RRN is rrn:<service>:<region>:<org>:<type>:… — so a resource states which
+    region it lives in, while the base URL is built from the instance's
+    configured region. Those two agree on a single-region tenant and need not on
+    a multi-customer key, which spans organizations.
+    """
+    parts = str(rrn or "").split(":")
+    return parts[2] if len(parts) > 4 and parts[0] == "rrn" and parts[2] else None
+
+
+def _collect_region_failures(out, sink):
+    """Carry a partial failure out of a response instead of dropping it.
+
+    The Alert Triage API answers HTTP 200 with a region_failures list when it
+    could not reach one of the regions behind the request — the spec says the
+    presence of items there IS the partial failure. Reading only the payload
+    turns that into missing alerts with no error anywhere, which for an
+    ingestion feed is indistinguishable from a quiet period.
+    """
+    for f in (out.get("region_failures") or []):
+        sink.append(f)
+    return out
+
+
 def run():
     inp = _inputs()
     limit = int(inp.get("limit") or 50)
@@ -108,13 +134,16 @@ def run():
 
     rrns_only = str(inp.get("rrns_only") or "").strip().lower() in ("1", "true", "yes")
     alerts, rrns, meta = [], [], {}
+    region_failures = []
     index = int(inp.get("index") or 0)
     while len(alerts) + len(rrns) < limit:
         size = min(PAGE, limit - len(alerts) - len(rrns))
-        out = request("POST", AT + "alerts/ops/search",
-                      params={"index": index, "size": size,
-                              "rrns_only": "true" if rrns_only else None},
-                      body=body)
+        out = _collect_region_failures(
+            request("POST", AT + "alerts/ops/search",
+                    params={"index": index, "size": size,
+                            "rrns_only": "true" if rrns_only else None},
+                    body=body),
+            region_failures)
         meta = out.get("metadata") or {}
         page_alerts = out.get("alerts") or []
         page_rrns = out.get("rrns") or []
@@ -124,6 +153,11 @@ def run():
             break
         index += 1
 
+    if not isinstance(meta, dict):
+        meta = {}
+    # A non-empty region_failures means alerts from that region are missing from
+    # this page, on an otherwise successful response.
+    meta["region_failures"] = region_failures
     result = {"metadata": meta}
     if rrns_only:
         result["rrns"] = rrns[:limit]