fix(sentinelone): type the assignee mutation as the console does (1.17.1)

update_uam_alert_assignee declared the action id as String! and the user
as ID!; the console types them ID! and Long and refused the mutation at
validation (VariableTypeMismatch), so no alert was ever assigned.

The user id now goes out as a JSON number, and a value that is not the
numeric console id is refused with an error naming assignee_user_id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013u8PFdkYuuPiC6JdZBV5x3

integrations/sentinelone/scripts/update_uam_alert_assignee.py

@@ -3,9 +3,13 @@ import json, os, sys, urllib.request, urllib.parse, urllib.error
 # Assignment rides the same alertTriggerActions mutation as the status and
 # verdict updates, with the assignUser payload. The action id is the console's,
 # and can be overridden for a tenant that names it differently.
+#
+# The variable types are the console's, not a guess: the action id is an ID!
+# and assignUser.value a Long. Declared String! and ID!, the console rejected
+# the mutation at validation (VariableTypeMismatch) before assigning anything.
 DEFAULT_ACTION_ID = "S1/alert/assignUser"
 
-MUTATION = """mutation AlertTriggerActions($id: String!, $actionId: String!, $user: ID!) {
+MUTATION = """mutation AlertTriggerActions($id: String!, $actionId: ID!, $user: Long) {
   alertTriggerActions(
     filter: { or: [ { and: [ { fieldId: "id", stringEqual: { value: $id } } ] } ] },
     actions: [ { id: $actionId, payload: { assignUser: { value: $user } } } ]
@@ -43,12 +47,18 @@ def main():
     if not alert_id or not user_id:
         raise ValueError("alert_id and assignee_user_id are required")
 
+    # A Long is a number: an email or a display name would only be refused by
+    # the console with a type error that does not say which input was wrong.
+    if not user_id.isdigit():
+        raise ValueError("assignee_user_id must be the console's numeric user id "
+                         "(assignee.userId, or the id from list users), got " + repr(user_id))
+
     variables = {
         "id": alert_id,
         "actionId": str(inputs.get("action_id") or "").strip() or DEFAULT_ACTION_ID,
-        # The console types the user id as an ID, which accepts the number it
-        # returns in assignee.userId as well as its string form.
-        "user": int(user_id) if user_id.isdigit() else user_id,
+        # Sent as a JSON number. Python's int keeps the 19 digits of a console
+        # id exactly; it fits the Long the console declares.
+        "user": int(user_id),
     }
     resp = request("POST", base + "/unifiedalerts/graphql", headers, {"query": MUTATION, "variables": variables})
     if resp.get("errors"):