[sentinel_one] Add Support for Threat Event Data Stream

[mohitjha-elastic]

Proposed commit message

sentinel_one: Add support for threat event data stream.

Added support for ingesting data through the SentinelOne Threat Event data stream, 
enabling the collection and parsing of threat-related events for accurate ingestion
and processing of security insights.

Tested on the live samples collected through the SentinelOne API.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/sentinel_one directory.
• Run the following command to run tests.

elastic-package test -v

Related Issue

• Closes Sentinel One: Update documentation per new template  #15633
• Closes https://github.com/elastic/enhancements/issues/25418

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[mohitjha-elastic]

Will update the kibana version once the ILM Policy Index Deletion PR will be merged.

[efd6]

Suggested change

	"want_more": state.?fetch_more.orValue(false) ?
	state.fetch_more
	:
	"want_more": state.?fetch_more.orValue(false) ?
	state.fetch_more
	:

will fix the policy test failures.

[mohitjha-elastic]

Thanks!

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

LGTM after query

[mohitjha-elastic]

Updated the kibana version as the ILM Policy Index Deletion PR has been merged. Will merge this PR after the public release.

[efd6]

Needs elastic-package test policy -g.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e95d3a9

History

• 💔 Build #33697 failed c9fe680
• 💔 Build #33641 failed 9d6addf
• 💚 Build #33246 succeeded fbc8a44
• 💔 Build #33231 failed 27e61ff
• 💔 Build #33228 failed cd06861

cc @mohitjha-elastic

[efd6]

Still LGTM

[kcreddy]

@mohitjha-elastic, feel free to merge this PR as the corresponding stack versions are released now.

[elastic-vault-github-plugin-prod]

Package sentinel_one - 1.43.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/1.43.0/