[Bug] Update Sort Parameter

[eric-forte-elastic]

Issues

#3530

Summary

This PR updates the sort parameter so that the collect-events command functions correctly with the elasticsearch 8.12 python library. See issue for more background/context info.

Testing

Run collect events and make sure you can collect data. If data is collected, the test is successful.

endpoint-rules on  2356-fr-add-host-family-to-data-path [?] via  v3.8.10 (venv) on  eric.forte took 20s 
❯ python -m endpoint_rules es --cloud-id <cloud_id> collect-events --rta-name bitsadmin_execution <host_id>

███████╗███╗   ██╗██████╗ ██████╗  ██████╗ ██╗███╗   ██╗████████╗
██╔════╝████╗  ██║██╔══██╗██╔══██╗██╔═══██╗██║████╗  ██║╚══██╔══╝
█████╗  ██╔██╗ ██║██║  ██║██████╔╝██║   ██║██║██╔██╗ ██║   ██║
██╔══╝  ██║╚██╗██║██║  ██║██╔═══╝ ██║   ██║██║██║╚██╗██║   ██║
███████╗██║ ╚████║██████╔╝██║     ╚██████╔╝██║██║ ╚████║   ██║
╚══════╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝╚═╝  ╚═══╝   ╚═╝
        ██████╗ ██╗   ██╗██╗     ███████╗███████╗
        ██╔══██╗██║   ██║██║     ██╔════╝██╔════╝
        ██████╔╝██║   ██║██║     █████╗  ███████╗
        ██╔══██╗██║   ██║██║     ██╔══╝  ╚════██║
        ██║  ██║╚██████╔╝███████╗███████╗███████║
        ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚══════╝╚══════╝

es_user: eric.forte
es_password: 
Press any key once detonation is complete ...
149 events saved to: /tmp/init_tmp/endpoint-rules/unit_tests/data/true_positives/bitsadmin_execution/windows/endpoint.ndjson
32 events saved to: /tmp/init_tmp/endpoint-rules/unit_tests/data/true_positives/bitsadmin_execution/windows/metricbeat.ndjson
2 events saved to: /tmp/init_tmp/endpoint-rules/unit_tests/data/true_positives/bitsadmin_execution/windows/filebeat.ndjson

[Mikaayenson]

LGTM

Just additional context for our future selves. The elasticsearch client basically ignores the old way we were passing sort params:

        # The 'sort' parameter with a colon can't be encoded to the body.
        if sort is not None and (
            (isinstance(sort, str) and ":" in sort)
            or (
                isinstance(sort, (list, tuple))
                and all(isinstance(_x, str) for _x in sort)
                and any(":" in _x for _x in sort)
            )
        ):
            __query["sort"] = sort
            sort = None