feat(sentinelone): default ingestion (get_threats fetch + OCSF mapper)

Declare get_threats as the default fetch command (results_path data, dedup id,
incremental created_after) with the bundled get_threats OCSF mapper and a
'SentinelOne Threat' default incident type. get_alerts is also marked
ingestion-ready (incremental created_from). Existing filters (mitigation
status, query, created window, limit) let an operator fetch a subset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/sentinelone/incident-types/sentinelone-threat.yaml

@@ -0,0 +1,3 @@
+name: "SentinelOne Threat"
+color: "#a020f0"
+icon: "alert"

integrations/sentinelone/manifest.yaml

@@ -43,6 +43,10 @@ commands:
         created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
       required: []
     outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: id
+      incremental_field: created_after
 
   - id: list_agents
     name: sentinelone-list-agents
@@ -288,6 +292,10 @@ commands:
         limit: { type: number, description: "Max results (default 100)." }
       required: [created_from]
     outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: id
+      incremental_field: created_from
   - id: update_alerts_verdict
     name: sentinelone-update-alerts-verdict
     description: "Set the analyst verdict on one or more cloud-detection alerts."
@@ -965,3 +973,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_threats
+  mapper: get_threats
+  default_incident_type: "SentinelOne Threat"