Use Elasticsearch events for automated testing.

[yashtewari]

Use of OPA decision logs to match findings against expected findings is now deprecated.

The deprecated function get_evaluation has been renamed to get_logs_evaluation but not yet deleted, because it's still useful for debugging.

Resolves: https://github.com/elastic/security-team/issues/4049

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b automated-tests-switch-to-elasticsearch upstream/automated-tests-switch-to-elasticsearch
git merge upstream/main
git push upstream automated-tests-switch-to-elasticsearch

[mergify]

This pull request does not have a backport label. Could you fix it @yashtewari? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  NOTE: backport-skip has been added to this pull request.

[github-actions]

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/289/index.html

[github-actions]

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/289/index.html

[oren-zohar]

looks good

[oren-zohar]

since you edited those files, can you please fix the linter comments from running

flake8 --ignore=E501,E126,E123 commonlib

[yashtewari]

Done

[github-actions]

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/289/index.html

[github-actions]

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/289/index.html

[github-actions]

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/289/index.html

[github-actions]

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/289/index.html

[DaveSys911]

Approved, please consider addressing the comments on subsequent prs
as part of https://github.com/elastic/security-team/issues/4296 perhaps.

[DaveSys911]

This introduces an additional function that interfaces with ES, I suggest considering moving it to commonlib/elastic_wrapper.py.

In addition, it might be a good idea to patch up the tests in [tests/integration] (https://github.com/elastic/cloudbeat/blob/main/tests/integration/tests/test_cloudbeat_integration.py) to access ES using the same method.

The current convention is a bit confusing.

[oren-zohar]

Can you also please open a ticket for the debug mode degradation?