[Sublime Security]: Sublime Security - map attack score verdict

### Integration Name

Sublime Security [packages/sublime_security]

### Dataset Name

event.original

### Integration Version

1.14.0

### Agent Version

v 9.5.2

### Agent Output Type

elasticsearch

### Elasticsearch Version

v 9.5.2

### OS Version and Architecture

Kubernetes - Standalone agent

### Software/API Version

_No response_

### Error Message

_No response_

### Event Original

{
"created_at": "2026-08-03T14:24:49.524276Z",
"data": {
"flagged_rules": [
{
"attack_types": ["Credential Phishing"],
"detection_methods": ["Content analysis", "Header analysis", "Natural Language Understanding", "Sender analysis"],
"id": "[REDACTED]",
"label": null,
"name": "Impersonation: Internal corporate services",
"severity": "high",
"tactics_and_techniques": ["Impersonation: Employee", "Social engineering"],
"tags": null
}
],
"message": {
"attack_score_verdict": "likely_benign",
"canonical_id": "[REDACTED]",
"created_at": "2026-08-03T14:24:43.017869Z",
"external_id": "[REDACTED]",
"id": "[REDACTED]",
"mailbox": {
"email": "[REDACTED]",
"external_id": "[REDACTED]",
"id": "[REDACTED]"
},
"message_source_id": "[REDACTED]",
"recipients": [
{"email": "[REDACTED]"},
{"email": "[REDACTED]"}
],
"sender": {
"display_name": "[REDACTED]",
"email": "[REDACTED]"
},
"subject": "[REDACTED]"
}
},
"org_id": "[REDACTED]",
"type": "message.flagged"
}

### What did you do?

I have noticed that Sublime started sending attack score data ("attack_score_verdict") as of recently and currently it is not a mapped field - it is seen in the event.original only. Could you map it on ingest?

### What did you see?

Unmapped field value for "attack_score_verdict"

### What did you expect to see?

I'd expect attack_score_verdict to have its own field now that it gets ingested

### Anything else?

_No response_