fix: Use fresh UUID for email alerts to prevent UAM silent drops and update classification ID

- Changed email alert resource UID from shared GUID to fresh UUID (uuid.uuid4()) to prevent S1 UAM from silently dropping site-scoped alerts with static resource UIDs
- Updated proofpoint_email_alert.json s1_classification_id from 1 to 28
- Removed email_asset_uid caching logic that was causing alert deduplication issues

Author: jmorascalyr

Backend/api/app/alerts/templates/proofpoint_email_alert.json

@@ -36,5 +36,5 @@
     "attack_surface_ids": [1],
     "severity_id": 4,
     "state_id": 1,
-    "s1_classification_id": 1
+    "s1_classification_id": 28
 }

Backend/scenarios/apollo_ransomware_scenario.py

@@ -341,16 +341,12 @@ def send_phase_alert(
     alert["metadata"]["logged_time"] = time_ms
     alert["metadata"]["modified_time"] = time_ms
 
-    # Set resource - use XDR Asset ID for endpoint alerts, shared GUID for email/user alerts
+    # Set resource - use XDR Asset ID for endpoint alerts, fresh UUID for email/user alerts
     target_machine = mapping.get("target_machine", "bridge")
     if target_machine == "email":
-        # Proofpoint/M365 alerts link to the user email with a consistent GUID
-        email_asset_uid = uam_config.get('email_asset_uid')
-        if not email_asset_uid:
-            email_asset_uid = str(uuid.uuid5(uuid.NAMESPACE_DNS, VICTIM_PROFILE["email"]))
-            uam_config['email_asset_uid'] = email_asset_uid
+        # Fresh UUID each time — S1 UAM silently drops site-scoped alerts with static resource UIDs
         alert["resources"] = [{
-            "uid": email_asset_uid,
+            "uid": str(uuid.uuid4()),
             "name": VICTIM_PROFILE["email"]
         }]
     elif target_machine == "enterprise":