[AI4DSOC] Fix last event ingested for sentinel_one integration

[PhilippeOberti]

Summary

This PR fixes a very small issue where the last sync value for the sentinel_one integration was not showing up, while alerts were clearly fetched and rendered in the alerts table.

Doing some investigation, we discovered that the documents ingested for the integrations like crowdstrike and others have the following key/value pair: event.kind: "alert".
For the sentinel_one integration though, the event.kind field has event as a value.

The original ESQL query I wrote to fetch the documents was:

FROM ${`logs-${integrationName}.alert-default`}
    | WHERE event.kind == "alert"
    | SORT event.ingested DESC
    | KEEP event.ingested
    | LIMIT 1

Updating it to

FROM ${`logs-${integrationName}.alert-default`}
    | WHERE event.kind == "alert" OR event.kind == "event"
    | SORT event.ingested DESC
    | KEEP event.ingested
    | LIMIT 1

ensures that we will look at all those documents to see if the index has had some recent activity.

At first we thought we could remove the | WHERE event.kind == "alert" section entirely from the query, but we have some documents with a event.kind: "pipline_error" which we do NOT want to take into account.

As you can see, for integrations like crowdstrike, the document retrieve does not change:
Old:

New:

But for sentinel_one, the new query fixes the issue:
Old:

New:

#230110

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[NicholasPeretti]

Sneaky little one! Great job! ☺️

[kibanamachine]

Starting backport for target branches: 8.19, 9.1

https://github.com/elastic/kibana/actions/runs/16682683494

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.19
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation