Test elastic-package#3348 - DO NOT MERGE

[elastic-vault-github-plugin-prod]

Update elastic-package reference to elastic/elastic-package@09d02a3.
Automated by Buildkite build

Relates: elastic/elastic-package#3348

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 3f7cf96

Failed CI Steps

• Check integrations m365_defender
• Check integrations m365_defender
• Check integrations m365_defender
• Check integrations microsoft_defender_cloud
• Check integrations microsoft_defender_cloud
• Check integrations microsoft_defender_cloud
• Check integrations snort
• Check integrations ti_abusech
• Check integrations ti_abusech
• Check integrations ti_abusech

History

cc @chrisberkhout

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package azure 👍(7) 💚(3) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
auditlogs	4405.29	3095.98	-1309.31 (-29.72%)	💔
identity_protection	6451.61	3846.15	-2605.46 (-40.38%)	💔

To see the full report comment with /test benchmark fullreport

[github-actions]

Buildkite failure is real, but the public job logs for this build are not accessible anonymously; I could still narrow this to a dependency/regression surface in this PR.

Build: https://buildkite.com/elastic/integrations/builds/39382

What failed: 3 package test steps failed after retries in the integrations pipeline:

• Check integrations m365_defender
• Check integrations microsoft_defender_cloud
• Check integrations ti_abusech

Error: Buildkite reports non-zero exits for the final failed jobs (exit_status: 1) for those three steps. The public /data/steps?state=failed and /data/jobs endpoints are accessible, but direct public job log pages for the failing job UUIDs return 404 Page not found, so the exact stack trace text is not retrievable without authenticated/internal access.

Evidence from public Buildkite data endpoints

• Failed steps endpoint: /elastic/integrations/builds/39382/data/steps?exclude_group_steps=true&state=failed
• Failing commands reported by Buildkite:
  • .buildkite/scripts/test_one_package.sh m365_defender origin/main 3f7cf96a03fa673de534c6795377d06d965bc3b6
  • .buildkite/scripts/test_one_package.sh microsoft_defender_cloud origin/main 3f7cf96a03fa673de534c6795377d06d965bc3b6
  • .buildkite/scripts/test_one_package.sh ti_abusech origin/main 3f7cf96a03fa673de534c6795377d06d965bc3b6
• Final failed job UUIDs (after retries):
  • 019cd802-5145-4256-8e54-ec46a9ba6df8
  • 019cd802-6993-4ad4-a9db-b0362214cf86
  • 019cd7ec-1aac-45fe-97e3-23dd639961c8

Root cause (most likely): Dependency issue / upstream regression introduced by this PR’s dependency override.

The PR modifies only go.mod and go.sum and adds a replace to a forked elastic-package commit:

• go.mod (PR Test elastic-package#3348 - DO NOT MERGE #17731): replace github.com/elastic/elastic-package => github.com/chrisberkhout/elastic-package v0.0.0-20260310102038-09d02a38246f

Given the changed surface and simultaneous failures across 3 unrelated integrations, this points to behavior changes in the overridden elastic-package revision rather than package-specific integration code.

Recommended fix:

1. Validate by temporarily removing the replace override (or pinning back to the previous known-good github.com/elastic/elastic-package version) and re-running the same Buildkite package checks.
2. If the failures clear, keep the override reverted until the upstream change includes a fix.
3. If override is required for PR elastic-package#3348, add a compatibility patch in that branch and retest the same 3 packages first:
   • m365_defender
   • microsoft_defender_cloud
   • ti_abusech

Verification: I verified build/step/job metadata via public Buildkite JSON endpoints and PR diff scope; I could not retrieve raw failing stack traces because anonymous access to the job log pages for these job UUIDs returns 404.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.