fix(sentinelone): count the host's other alerts from what was read (1.19.1)

A real run answered one other alert and named none: the count came
from the console's total minus the alert itself, and that total did
not hold the alert.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/sentinelone/scripts/investigate_alert.py

@@ -291,13 +291,20 @@ def investigate_uam(con, alert_id, days):
             '{ fieldId: "detectedAt" dateTimeRange: { start: %d end: %d } }' % (start.timestamp() * 1000, end.timestamp() * 1000),
         ], SIBLING_FIELDS, 100))
         alerts = (sib or {}).get("alerts") or {}
-        nodes = [e["node"] for e in alerts.get("edges") or [] if e.get("node") and e["node"].get("id") != alert_id]
+        edges_all = [e["node"] for e in alerts.get("edges") or [] if e.get("node")]
+        nodes = [n for n in edges_all if n.get("id") != alert_id]
         if sib is not None:
-            elsewhere["same_host_other_alerts"] = compact({
-                "total": max((alerts.get("totalCount") or 0) - 1, len(nodes)),
-                "read": len(nodes),
-                "by_name": group_count(nodes, lambda n: n.get("name"), lambda n: n.get("detectedAt") or ""),
-            })
+            # Counted from what was read, never from totalCount minus one: a
+            # real run reported "1 other alert" with none to name, because the
+            # console's total did not hold this alert. The console's own count
+            # is only given when more alerts exist than were read.
+            other = {"count": len(nodes),
+                     "by_name": group_count(nodes, lambda n: n.get("name"), lambda n: n.get("detectedAt") or "")}
+            total = alerts.get("totalCount")
+            if total is not None and total > len(edges_all):
+                other["console_total_including_this_alert"] = total
+                other["note"] = "more alerts than the 100 read"
+            elsewhere["same_host_other_alerts"] = compact(other) if nodes else "none"
     if agent:
         elsewhere["same_host_threats"] = threats_summary(con, "threats_on_host", {
             "agentIds": agent.get("id"), "createdAt__gt": iso(start), "createdAt__lt": iso(end)})