fix(socradar): overlap fetch windows to avoid missing late-visible OPEN alarms

[Radargoger]

Description

Update to the existing integrations/socradar integration. No new files, no directory changes — 5 modified files, +72/−29.

1. Inbound: configurable fetch overlap window (wodles/socradar.py, 1.0.2 → 1.0.3)

The wodle previously used last_run_epoch → now as its query window. SOCRadar's API can make an alarm visible slightly after its own creation timestamp, so an alarm created just before last_run advanced could fall outside every subsequent window and never be ingested.

Steady-state runs now re-query a trailing window controlled by the new fetch_overlap_seconds key (default 900, range 0–86400, 0 disables), i.e. min(last_run, now - overlap) → now. Duplicates are not re-emitted: the existing seen_alarm_ids state is consulted on the emit path, so the overlap only recovers alarms that were never seen. First runs are unaffected and still use initial_lookback_hours.

2. Outbound: idempotent tag and comment (integration/custom-socradar.py, 1.0.1 → 1.0.2)

auto_tag and post_wazuh_context fired on every alert, so an alarm that re-alerted in Wazuh received duplicate wazuh-ingested tags and repeated context comments. The integration now checks the alert payload's tags for wazuh-ingested and skips both actions when it is already present, logging the skip. Combined with the overlap window above, re-queried alarms no longer generate outbound noise. The docstring version header (which had drifted to 1.0.0) is corrected to match VERSION.

3. Configuration and documentation consistency

• install.sh: writes fetch_overlap_seconds: 900 into the generated /var/ossec/etc/socradar.conf.
• socradar.conf.template: defaults aligned with the code — fetch_limit 50 → 100 (DEFAULT_PAGE_SIZE), max_pages 10 → null (unlimited, as get_max_pages already treated it), max_retry_pages 200 → 25 (the code default). Removed auto_comment_on_fetch, which is no longer read anywhere in the integration.
• README.md: documents fetch_overlap_seconds and corrects the configuration reference table where it did not match code behaviour (fetch_status is an optional filter rather than a default, min_severity maps to the API severities param rather than a numeric minimum, lookback_page_sleep_seconds defaults to page_sleep_seconds, max_retry_pages also accepts the legacy max_retry_windows key).
• README.md: adds a Provenance and Maintenance section per CONTRIBUTING.md — original source, adapting party, tested versions, maintainer and support boundary — replacing the previous single-line Author section.

Checks performed on this change

• python3 -m py_compile clean on wodles/socradar.py and integration/custom-socradar.py.
• bash -n install.sh clean.
• socradar.conf.template parses as valid JSON.
• Existing decoder and rules are untouched by this PR, so rule matching behaviour is unchanged.

Target platform remains Wazuh Manager 4.x (integration previously validated on 4.14.3) with Python 3.6+ and no external packages.

Maintenance

Vendor-maintained by the SOCRadar Integration Team (integrations@socradar.io); see the Provenance and Maintenance section of integrations/socradar/README.md.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.