Sentinel One bidirectional integration (tech preview)

[caitlinbetz]

First release of our bidirectional integration work - https://github.com/elastic/security-team/issues/6200

There are a handful of steps users must take to ensure they are able to successfully take action on Sentinel One hosts (for the initial tech preview release in 8.12, the only action is to isolate / release a host). We want to make sure we have a page that walks through the full configuration requirements.

Prerequesites:

• Should have active running S1 agents

High level steps:

1. Ensure there is an agent policy created (Fleet) that will be responsible for pulling S1 data)
2. Add and configure the Sentinel One integration to policy
3. Create a security detection rule to get elastic alerts for Sentinel One alerts
   • logs-sentinel_one.alert*
4. Create a connector for Sentinel One

[joepeeples]

#4312 already existed to track docs work on the SentinelOne integration, so I copied the info from this issue to that one, and will close this. Follow #4312 for further updates.