Group by assessment without a missing bucket

The assessment is a number, and SOC's missing bucket only works on keyword
fields, so the * made Elasticsearch fail parsing "__missing__" as a long.
Untriaged alerts now drop out of this view.

salt/soc/defaults.yaml

@@ -2525,7 +2525,7 @@ soc:
             - name: 'Group By Name, Module'
               query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
             - name: 'Group By Assessment, Name'
-              query: '* | groupby event.so_alerttriage.assessment* rule.name event.severity_label rule.uuid'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
               license: oai
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
               query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'