[sentinel_one] Add agent.id to all agent related data

[chrisberkhout]

Proposed commit message

[sentinel_one] Add agent.id to all agent related data (#)

If the data is associated with a SentinelOne agent, include the agent's
ID in the final document, as `sentinel_one.<source_type>.agent.id`.

For the `agent` and `threat` data streams, the value was already stored
in `host.id`, but it was added to `sentinel_one.<source_type>.agent.id`.

For the `activity` data stream, this was already done.

For the `alert` data stream, no agent ID is available. There is a field
`agentDetectionInfo.uuid`, described in the documentation as the
"UUID of the agent", which seems to be a different value, and was
already stored in `observer.serial_number`.

For the `group` data stream there is no field that identifies an agent.

It's was already done in the activity data stream here.

I checked the SentinelOne API documentation to confirm that for each endpoint there weren't additional relevant fields in responses.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Relates [SentinelOne] add agent.id to all agent related data collected from SentinelOne #9879

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 89d6281

History

• 💔 Build #12364 failed 77dd959

cc @chrisberkhout

[kcreddy]

LGTM

[elasticmachine]

Package sentinel_one - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=sentinel_one