fix(rapid7-insightidr): a partial region result is not a quiet period (v1.6.0)

An RRN states its region — rrn:alerts:eu:<org>:alert:… — while the base URL is
built from the instance's configured `region`. Following that thread found a
gap that matters more than the naming.

The Alert Triage API is multi-region behind one gateway, and eleven of its
endpoints can answer HTTP 200 with a region_failures list. The spec is explicit:
the presence of items in that field IS the partial failure. Three of the
commands here call such endpoints and all three read only the payload, so a
region the gateway could not reach produced fewer alerts and nothing else — no
error, no count, no log line. For an ingestion feed that is indistinguishable
from a quiet period, which is the one failure mode this integration has now hit
three separate times.

So region_failures is carried into the run metadata by every command that can
receive it, alongside the regions actually seen in the collected RRNs, the
configured region, and any mismatch between them.

The mismatch report is deliberately a report and not a correction. On a
single-region tenant the two always agree. On a multi-customer key, which spans
organizations, they need not — and rewriting the host per resource would be a
guess about how Rapid7 routes these calls, made without a tenant to verify it
against. Naming the discrepancy is what can be done honestly today; if it ever
fires, the metadata says so instead of the alerts silently going missing.

list_alert_fields already passed region_failures through untouched, since it
returns the API response as it stands.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/rapid7-insightidr/scripts/search_investigation_alerts.py

@@ -14,6 +14,10 @@ def _cfg():
     return base, headers, multi
 
 
+def _cfg_region():
+    return str(json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")).get("region") or "us").strip().lower()
+
+
 def _inputs():
     return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
 
@@ -72,6 +76,32 @@ def _alert_rrn(a):
     return None
 
 
+def _rrn_region(rrn):
+    """The region segment of an RRN, or None.
+
+    An RRN is rrn:<service>:<region>:<org>:<type>:… — so a resource states which
+    region it lives in, while the base URL is built from the instance's
+    configured region. Those two agree on a single-region tenant and need not on
+    a multi-customer key, which spans organizations.
+    """
+    parts = str(rrn or "").split(":")
+    return parts[2] if len(parts) > 4 and parts[0] == "rrn" and parts[2] else None
+
+
+def _collect_region_failures(out, sink):
+    """Carry a partial failure out of a response instead of dropping it.
+
+    The Alert Triage API answers HTTP 200 with a region_failures list when it
+    could not reach one of the regions behind the request — the spec says the
+    presence of items there IS the partial failure. Reading only the payload
+    turns that into missing alerts with no error anywhere, which for an
+    ingestion feed is indistinguishable from a quiet period.
+    """
+    for f in (out.get("region_failures") or []):
+        sink.append(f)
+    return out
+
+
 def run():
     _, _, multi = _cfg()
     inp = _inputs()
@@ -104,6 +134,7 @@ def run():
     # 2) Their alert RRNs. One call per investigation — there is no bulk form —
     #    so this is the step the time budget guards.
     order, by_rrn, truncated, skipped = [], {}, False, 0
+    region_failures, regions_seen = [], set()
     for inv in investigations:
         if time.monotonic() - started > budget or len(order) >= max_alerts:
             truncated = True
@@ -123,6 +154,9 @@ def run():
             if rrn is None:
                 skipped += 1
                 continue
+            r = _rrn_region(rrn)
+            if r:
+                regions_seen.add(r)
             if rrn not in by_rrn:
                 order.append(rrn)
                 by_rrn[rrn] = inv
@@ -140,7 +174,7 @@ def run():
         body = {"rrns": batch}
         if field_ids:
             body["field_ids"] = field_ids
-        out = request("POST", AT + "alerts/ops/rrns", body=body)
+        out = _collect_region_failures(request("POST", AT + "alerts/ops/rrns", body=body), region_failures)
         alerts.extend(out.get("alerts") or [])
 
     # The investigation each alert came from, carried alongside so a mapper can
@@ -161,6 +195,10 @@ def run():
             "alerts_returned": len(alerts),
             "alert_ids_without_rrn": skipped,
             "truncated": truncated,
+            "region_failures": region_failures,
+            "regions_seen": sorted(regions_seen),
+            "configured_region": _cfg_region(),
+            "region_mismatch": sorted(r for r in regions_seen if r != _cfg_region()),
             "elapsed_seconds": round(time.monotonic() - started, 1),
         },
     }))