[sentinel_one] Enhance ECS Mappings and Unify Field Structures across all Data Streams

[mohitjha-elastic]

Proposed commit message

sentinel_one: Enhance ECS mappings and unify fields across all data streams.

Refined and expanded ECS field mappings to ensure consistency across all data streams. 
Aligned field names and structures with the latest ECS standards to improve interoperability, 
data quality, and search normalization in Elastic SIEM.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/sentinel_one directory.
• Run the following command to run tests.

elastic-package test -v

Related Issue

• Closing Sentinel One: ECS compatibility #15723

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package sentinel_one 👍(6) 💚(6) 💔(4)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
application_risk	9718.17	7812.5	-1905.67 (-19.61%)	💔
group	34843.21	25000	-9843.21 (-28.25%)	💔
threat_event	7390.98	5747.13	-1643.85 (-22.24%)	💔
application	20120.72	16501.65	-3619.07 (-17.99%)	💔

To see the full report comment with /test benchmark fullreport

[kcreddy]

@cpascale43 can you confirm if this requires a dashboard changes as well?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 74998e6

History

• 💚 Build #34371 succeeded bfbd021
• 💚 Build #33952 succeeded 3628d67

cc @mohitjha-elastic

[elastic-vault-github-plugin-prod]

Package sentinel_one - 2.0.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/2.0.0/