fix(sentinelone): accept a skipped UAM update when the alert is already set (1.17.3)

The console skips an alert already in the requested state, and 1.17.2
failed every skip: re-assigning an alert to its current holder, as a
second run of the same playbook does, broke the block.

A skipped alert is now read back. Already assigned to that user, or
already carrying that status or verdict, the block succeeds with
already_assigned / already_set; otherwise it fails naming the state the
console holds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013u8PFdkYuuPiC6JdZBV5x3

integrations/sentinelone/scripts/update_uam_alert_verdict.py

@@ -40,7 +40,22 @@ def main():
     triggered = ((resp.get("data") or {}).get("alertTriggerActions") or {}).get("actions") or []
     failures = [f for a in triggered for f in (a.get("failure") or [])]
     skipped = [s for a in triggered for s in (a.get("skip") or [])]
-    if failures or skipped or not any(a.get("success") for a in triggered):
+    succeeded = any(a.get("success") for a in triggered)
+    if skipped and not failures and not succeeded:
+        # The console skips an alert already in the requested state. That is a
+        # done update, not a failed one — but only once the alert says so.
+        back = request("POST", base + "/unifiedalerts/graphql", headers, {
+            "query": "query AlertState($id: ID!) { alert(id: $id) { analystVerdict } }",
+            "variables": {"id": variables["id"]}})
+        now = ((back.get("data") or {}).get("alert") or {}).get("analystVerdict")
+        if str(now or "") == str(variables["verdict"] or ""):
+            resp["already_set"] = True
+            print(json.dumps(resp))
+            return
+        print(json.dumps({"error": "The console skipped the alert, which is analystVerdict " + str(now),
+                          "skip": skipped, "result": resp.get("data")}))
+        sys.exit(1)
+    if failures or not succeeded:
         print(json.dumps({"error": "The console did not update the alert",
                           "failure": failures, "skip": skipped, "result": resp.get("data")}))
         sys.exit(1)