fix(sentinelone): make the process tree draw itself (v1.15.0)

The block reads actor.process.file.name and would have rendered the chain,
but mapperHasProcessChain — the test that places it when a layout is
generated from a mapper — wants actor.process.name alongside the parent's.
This mapper declared only the file name, so the block was never placed and
the chain went unseen on every SentinelOne incident.

process.file.name now feeds both, and certSubject feeds the node's signer
badge (the block reads file.company_name for it, and certSubject is the only
signing identity a unified alert carries).

Verified by running processTree.ts itself over this mapper's output on the
live ClickFix alert: placement true, and a two-node chain explorer.exe ->
powershell.exe carrying the host, the user, both paths and both sets of
hashes when the fetch ran with_details. Without it the chain still draws,
with the parent named but unhashed — which is all the list nodes say.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Rk9N6vNtp3q7YvLpjcc

integrations/sentinelone/mappers/get_unified_alerts.yaml

@@ -93,6 +93,11 @@ ocsf:
   - { source_path: "detectionTime.kubernetes.containerImageName", ocsf_field: "container.image.name" }
   - { source_path: "detectionTime.kubernetes.podName",            ocsf_field: "container.pod_uuid" }
   # ── Detected process — the actor ──────────────────────────────────
+  # actor.process.name alongside the file name: the process-tree block reads
+  # either, but places itself automatically only on a mapper that declares
+  # actor.process.name together with the parent's, and a chain of two named
+  # processes is exactly what this alert carries.
+  - { source_path: "process.file.name",        ocsf_field: "actor.process.name" }
   - { source_path: "process.cmdLine",          ocsf_field: "actor.process.cmd_line" }
   - { source_path: "process.parentName",       ocsf_field: "actor.process.parent_process.name" }
   - { source_path: "process.file.name",        ocsf_field: "actor.process.file.name" }
@@ -107,6 +112,9 @@ ocsf:
   - { source_path: "process.file.sha1",        ocsf_field: "file.hashes.sha1" }
   - { source_path: "process.file.md5",         ocsf_field: "file.hashes.md5" }
   - { source_path: "process.file.certSubject", ocsf_field: "file.signature.value" }
+  # The signer badge on the process node reads company_name; certSubject is the
+  # only signing identity a unified alert carries.
+  - { source_path: "process.file.certSubject", ocsf_field: "actor.process.file.company_name" }
   # ── Triage ownership ──────────────────────────────────────────────
   - { source_path: "assignee.fullName",        ocsf_field: "assignee.name" }
   - { source_path: "assignee.email",           ocsf_field: "assignee.email_addr" }