[AI4DSOC] [QRadar] The last synced time is not available for QRadar integration

[muskangulati-qasource]

Describe the bug
The last synced time is not available for QRadar integration

Kibana/Elasticsearch Stack version

VERSION: 9.4.0
BUILD: 99735
COMMIT: 1077add3de6d4341b56dfe60ca9a157aede7a1b6

Steps

1. Kibana AI4DSOC SERVERLESS environment should exist
2. Alerts for QRadar integration should exist
3. Navigate to the Alert Summary tab
4. Observe that the last sync is not available for the QRadar integration

Expected Result
The last sync time should be available for the QRadar integration

Screenshot

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[muskangulati-qasource]

@arvindersingh-qasource please review!

[arvindersingh-qasource]

Reviewed and Assigned to @pborgonovi

[pborgonovi]

@kgeller would you be able to help us with this one or point me to someone who could?

There is an inconsistency between the index used for alert generation and the index expected by the Last Synced indicator in the IBM QRadar integration page.
When the IBM QRadar integration is installed, the datastream logs-ibm_qradar.offense-default is created automatically. Documents ingested into this index are correctly picked up by the IBM QRadar External Alerts detection rule and alerts appear in the alert table as expected.
However, the Last Synced field on the integration page remains empty (—) when data exists only in logs-ibm_qradar.offense-default. Upon investigation, the Last Synced indicator appears to read from a different index: logs-ibm_qradar.alert-default. When that index is manually created and populated, Last Synced updates correctly — but documents in that index are not picked up by the detection rule and no alerts are generated.
This creates a conflict where no single index satisfies both behaviors simultaneously. It is unclear which index is the intended source of truth for the IBM QRadar integration.

cc @PhilippeOberti