docs(sublime): fix the audit log adapter options and example config

[maximelb]

Summary

Fixes the Sublime Security audit log adapter page:

• api_key was described as "your Okta API key/token".
• Documents the optional base_url option and its North America default (https://platform.sublime.security).
• The Infrastructure as Code example used the json platform with sensor_hostname_path: "user.email". Audit events have no such field, and LimaCharlie paths use /, not .. The example now uses the sublime platform, which already takes the event type from type and the event time from created_at, so no mapping is needed.
• States that the adapter polls every 30s and does not backfill the audit history that existed before it started.
• Adds a troubleshooting section: a binary adapter with a different sensor_seed_key shows up as a separate sensor from the cloud sensor, deleting a sensor does not stop a cloud sensor that is still configured, and the mapping to use with the json platform.

Verification

Ran the sublime adapter against a live Sublime tenant with both the sublime platform and the json platform plus mapping. In both cases the audit events arrived with the correct event type and timestamp. markdownlint reports no issues.

Adapter change: see refractionPOINT/usp-adapters pull request 301.

🤖 Generated with Claude Code

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/documentation 63ebecf…abb7d0a — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.

[maximelb]

Self-review (this repo does not use /lc-review). An independent adversarial reviewer checked this diff from a pristine git archive extraction, against the adapter code in refractionPOINT/usp-adapters#301:

• Confirmed against the code:
  • the 30s poll interval, which is not configurable
  • no backfill of history
  • the api_key and base_url option names
  • the https://platform.sublime.security default
  • the sublime platform, whose parser takes the event type from type and the time from created_at, so no mapping is needed
• Added after the review: the adapter keeps no position between runs, so audit events created while it is stopped or restarting are not shipped. This is now stated.
• Troubleshooting claims: checked against the platform's behavior.
  • A sensor removed while its cloud sensor configuration still exists reconnects and re-enrolls.
  • Adapters with different sensor_seed_keys register as separate sensors.
  • Both configs in this page (sublime, and json with the stated mapping) were run live, and the audit events arrived with the correct type and time.
• Identifying information: none in the diff; only placeholders are used.
• markdownlint reports no issues.