Group by assessment without a missing bucket

The assessment is a number, and SOC's missing bucket only works on keyword
fields, so the * made Elasticsearch fail parsing "__missing__" as a long.
Untriaged alerts now drop out of this view.

salt/soc/defaults.yaml

@@ -2524,6 +2524,9 @@ soc:
           queries:
             - name: 'Group By Name, Module'
               query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
+            - name: 'Group By Assessment, Name'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
+              license: oai
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
               query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'

salt/soc/soc_soc.yaml

@@ -1209,6 +1209,8 @@ soc:
             - field: showSubtitle
               label: Show Query in Dropdown.
               forcedType: bool
+            - field: license
+              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
           queryToggleFilters:
             description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
             global: True