feat(sentinelone): scope threat and alert fetches to given accounts (v1.4.0)

A multi-tenant console returns every account's threats and alerts at once.
get_threats and get_alerts now take an optional account_ids input, passed
through as the accountIds query parameter, so an ingestion can be pinned to
the accounts the SOC actually watches.

The input is optional, so existing instances and running ingestions keep
their current behaviour.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/sentinelone/scripts/get_alerts.py

@@ -31,6 +31,7 @@ def main():
         "analystVerdict": inputs.get("analystVerdict"),
         "ids": inputs.get("alert_ids"),
         "siteIds": inputs.get("site_ids"),
+        "accountIds": inputs.get("account_ids"),
         "limit": int(inputs.get("limit") or 100),
     }
     url = base + "/cloud-detection/alerts?" + urllib.parse.urlencode({k: v for k, v in qs.items() if v not in (None, "")})

integrations/sentinelone/scripts/get_threats.py

@@ -27,6 +27,8 @@ def main():
         qs["ids"] = str(inputs["threat_ids"])
     if inputs.get("created_after"):
         qs["createdAt__gt"] = str(inputs["created_after"])
+    if inputs.get("account_ids"):
+        qs["accountIds"] = str(inputs["account_ids"])
 
     url = base + "/threats?" + urllib.parse.urlencode(qs)
     print(json.dumps(request("GET", url, headers)))