[Sentinel_one] Add ILM Policy for unified alert data stream

[brijesh-elastic]

Proposed commit message

sentinel_one: add ILM Policy for unified alert data stream

It bumps the minimum version to ^8.19.13 || ^9.2.7 || ^9.3.2 as per the (Elasticsearch PR)[1].

[1] https://github.com/elastic/elasticsearch/pull/142648

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/sentinel_one directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Relates [sentinel_one] Add unified alert data stream #17304
• Relates [Sentinel One] Fix Cannot execute ILM policy delete step for unified alert elasticsearch#142648

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[macroscopeapp]

🔴 Critical ilm/default_policy.json:7

The delete phase uses "min_age": "15d", which causes data to be deleted 15 days after index creation even though lifecycle.yml declares data_retention: "30d". Users will lose data 15 days earlier than expected. Update both the rollover max_age and delete min_age to "30d" to match the declared retention.

-				"max_age": "15d",
+				"max_age": "30d",

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file packages/sentinel_one/data_stream/unified_alert/elasticsearch/ilm/default_policy.json around line 7:

The delete phase uses `"min_age": "15d"`, which causes data to be deleted 15 days after index creation even though `lifecycle.yml` declares `data_retention: "30d"`. Users will lose data 15 days earlier than expected. Update both the rollover `max_age` and delete `min_age` to `"30d"` to match the declared retention.

[brijesh-elastic]

According to documentation, the min_age in delete phase is relative to the index roll over time.

So, the order is:

1. Index creation: day 0
2. Index rollover: after day 15
3. Index deletion: day 30 (15 days from roll over)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b155da8

cc @brijesh-elastic