SentinelOne Singularity Operations Center: Expand Unified Alerts Connector to fetch extended process details and linked observables

[Arabindaksha-Mishra]

[b/556211510] SentinelOne Singularity Operations Center: Expand Unified Alerts Connector to fetch extended process details and linked observables

---

Description

What problem does this PR solve?
In SentinelOne Singularity Operations Center alerts, observables (IPs, hashes, domains, file paths) nested under threat indicators and parent process execution telemetry were previously omitted during ingestion by the Unified Alerts Connector. This limited alert context and prevented key ontology mappings (such as parent process details, file hashes, and threat signatures) from populating Chronicle SOAR cases.

How does this PR solve the problem?

• Extended GraphQL Query: Updated GET_ALERT_DETAILS_QUERY to fetch observables (name, type, typeName, value) linked under threat indicators.
• Model Updates:
  • Added parent_indicator linking to AlertObservable and enhanced AlertIndicator with uid, message, event_time, and severity.
  • Added canonical mapping in AlertObservable.as_event() (ip, dns, domain, url, file_hash) and indicator context fields (indicator_uid, indicator_type, indicator_message, indicator_severity).
  • Implemented $O(1)$ set-based deduplication in SentinelOneAlert.to_alert_info() using (obs.type, obs.value, obs.name).
• Ontology Mapping: Added mapping rules for FileHash, ParentProcessName, ParentCommandLine, ParentFilePath, ParentFileHash, ProcessId, and ParentProcessId, and updated ThreatSignature to fallback on indicator_message.

---

Checklist:

General Checks:

• I have read and followed the project's contributing guide.
• My code follows the project's coding style guidelines.
• I have performed a self-review of my own code.
• My changes do not introduce any new warnings.
• My changes pass all existing tests (mp test).
• I have added new tests where appropriate to cover my changes.
• I have updated documentation / release notes (release_notes.yaml).

For Google Team Members and Reviewers:

• I have included the Buganizer ID in the PR title (b/556211510).
• I have ensured that all internal discussions and PII remain in Buganizer.
• All validations passed (mp validate 23/23, mp check --fix 0 errors).