SentinelOne Documentation

Allows a SentinelOne administrator or analyst interact with the SentinelOne product.


Version	6.0.0
Build	20251216
Splunk Enterprise Versions	10.0, 9.4, 9.3, 9.2
Platforms	Splunk Enterprise, Splunk Cloud
Splunkbase Url	https://splunkbase.splunk.com/app/5433
Author	Aplura, LLC

License

Apache License, Version 2.0 https://www.apache.org/licenses/LICENSE-2.0.txt

Copyright 2020-2024, Sentinel Labs, Inc.

Initial Application Configuration

SentinelOne is configured from the Application Configuration menu option under the Administration menu.

Macros

SentinelOne includes the following macros that control dashboard searches.

None

Sourcetype Definitions


sourcetype	SentinelOne API	Description
sentinelone:channel:agents	web/api/v2.1/agents	S1 Agent information
sentinelone:channel:activities	web/api/v2.1/activities	S1 Console Activities
sentinelone:channel:threats:event	web/api/v2.1/threats/\<threat_id>/explore/events	Get all threat events
sentinelone:channel:applications	web/api/v2.1/installed-applications	Get Application Inventory
sentinelone:channel:threats	web/api/v2.1/threats	Get the S1 Threats
sentinelone_app_for_splunk:error:event	Internal Error Logging	Errors that occur during threat event processing.
sentinelone_app_for_splunk:error	Internal Error Logging	Errors that occur during processing.
sentinelone:error	Internal Error Logging	Deprecated
sentinelone:channel:groups	web/api/v2.1/groups	Get S1 Groups
sentinelone:channel:applications:cve	web/api/v2.1/installed-applications/cves	Get known CVEs for applications that are installed on endpoints with Application Risk-enabled Agents
sentinelone:channel:application_management:risks	web/api/v2.1/application-management/risks	Get Application risks
sentinelone:channel:application_management:inventory	web/api/v2.1/application-management/inventory	Get Application Inventory
sentinelone:channel:uam_alerts	unifiedalerts/graphql	Get UAM Alerts via GraphQL API

Dashboards

SentinelOne includes the following dashboards.
- Application Configuration
- Allows the Splunk admin to configure the inputs for ingestion.
- Application Health Overview (under the Administration menu option)
- Use this page to get health and status information about any alerts, events, or API errors. View total_failures, messages, and severity level for each instance.
- Network
- This dashboard shows Agent information by over time, as well as group information.
- Threats
- This dashboard gives an overview of threats information in the console.
- Manage Agents Overview
- This dashboard provides the ability to manage Sentinel agents.
- Manage Threats Overview
- This dashboard provides the ability to manage incidents/threats.

SentinelOne Inputs

SentinelOne includes the following channels for the SentinelOne inputs. Make sure the interval schedules are reviewed prior to enablement.

These inputs use cron schedules, documentation can be found here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

To specify a cron schedule, use the following format:
  * "<minute> <hour> <day of month> <month> <day of week>"
  * Cron special characters are acceptable. You can use combinations of "*",
  ",", "/", and "-" to specify wildcards, separate values, specify ranges
  of values, and step values.
* The cron implementation for data inputs does not currently support names
  of months or days.

Applications
Interval : Recommended at no more than once per hour. ``0 * * * * ``
Groups
Interval : Recommended at no more than once per day. ``0 0 * * *``
Threats
Interval : Environment dependant. Smaller environments may be able to support every 1 minute ``* * * * *``.
Agents
Interval : Recommended at no more than once per day ``0 0 * * *``
Activities
Interval : Environment dependant. Smaller environments may be able to support every 1 minute ``* * * * *``.
Risks:
Interval : Environment dependant. Smaller environments may be able to support every 1 minute ``* * * * *``.
UAM Alerts:
Interval : Environment dependant. Smaller environments may be able to support every 1 minute ``* * * * *``.
View Type : Optional filter (ALL, ENDPOINT, IDENTITY, CLOUD, THIRD_PARTY, CUSTOM_ALERTS). Defaults to ALL.

About Lockfile Usage

The lock files were introduced to address a specific issue in Splunk Cloud environments where modular inputs were not completing before the next execution interval, causing data to never fully process. In multi-process environments like Splunk Cloud, modular inputs could start a new run on a different search head before the previous one finished, leading to duplication of efforts, incomplete data ingestion, and missed checkpoints. The lock file mechanism was added to prevent multiple instances of the same modular input from running simultaneously, ensuring that one input completes and writes out the checkpoint before another starts. This avoids the overload caused by pulling large amounts of data, especially in environments with high volumes of threats or agents.

In case of 'Splunk Victoria', this is the type of environment we would need to have the lock files.

However, in all other environments where our App is NOT installed on a Search Head cluster, the API will continue to pull and complete when finished before reaching out to the API on the next interval without the need of lock files. So decide accordingly while configuring the inputs in the application configuration page.

Note: If the user enables the lockfile checkbox, they must provide the duration of the lockfile in seconds. The valid range for the lockfile duration is between 300 and 3600 seconds, inclusive. If you need the lockfile but require a custom duration, you can provide any value by updating the configuration. Alternatively, feel free to modify the inputs.conf file to change the duration value.

Input Field Filtering

SentinelOne includes the ability to include or exclude fields that should be included when retrieving SentinelOne Inputs. Field filtering is configured under the Application Configuration dashboard on the Fields tab. You may specify fields that should be included for a channel or fields that should be excluded for a channel. If no filtering is defined for a channel all fields will be included by default.

If filtering nested JSON fields you should specify the field name with a "." between each key (e.g. activeDirectory.computerMemberOf). This will match the example below.

{"activeDirectory": {"computerMemberOf": "CN=global"}}

A wild card is supported for arrays of information. (activeDirectory.*.computerMemberOf). This will match the example JSON below.

{"activeDirectory": [{"computerMemberOf": "CN=global"}, {"computerMemberOf": "CN=global"}]}

Similarly, a wildcard is supported to target all elements in the array. (activeDirectory.lastUserMemberOf.*). This will match example JSON below.

{"activeDirectory": {"lastUserMemberOf": ["data1", "data2", "data3"]}}

Adaptive Alert Actions

SentinelOne includes the following adaptive alert actions.

Network Control
Allows the Splunk admin to manage the network status for an agent.
Action
- Connect or disconnect
Management Host
- Connect or disconnect
Site ID
- Site Id field
Agent ID
- Agent Id field
Threat Control
Allows the Splunk admin to configure the incident status and analyst verdict for a threat.
Incident Status
- Unresolved, In Progress, or Resolved
- In order to set the incident status to resolved a verdict must be specified
Analyst Verdict
- Undefined, True Positive, Suspicious, False Positive
Management Host
- Connect or disconnect
Site ID
- Site Id field
Threat ID
- Threat Id field

Custom Commands

SentinelOne includes the following custom commands.

sentineloneagentaction
Allows the Splunk admin to manage the network status for an agent.
action_type
- Connect or disconnect
management
- Connect or disconnect
site_id
- Site Id field (defaults to siteId)
agent_id
- Agent Id field (defaults to id)
Sample Usage
- index=sentinelone sourcetype="sentinelone:channel:agents" | fields id siteId | eval siteId=siteId."", management="testhost.sentinelone.net" | stats values(*) as * by id | sentineloneagentaction action_type=connect
sentinelonethreataction
Allows the Splunk admin to configure the incident status and analyst verdict for a threat.
status
- Incident status
- Unresolved, In Progress, or Resolved
- In order to set the incident status to resolved a verdict must be specified
verdict
- Undefined, True Positive, Suspicious, False Positive
management
- Connect or disconnect
site_id
- Site Id field (defaults to siteId)
threat_id
- Threat Id field (defaults to id)
Sample Usage
- index=sentinelone sourcetype="sentinelone:channel:threats" | fields id siteId | eval siteId=siteId."", management="testhost.sentinelone.net" | stats values(*) as * by id | sentinelonethreataction status=resolved verdict=false_positive
sentineloneapi
Allows the SentinelOne API to be quried for specific actions
management
- The Management host to use (from search results)
Current Features
- activity_types: pulls the activity types from the configured APIs.
Sample Usage
- | rest "/servicesNS/-/sentinelone_app_for_splunk/configs/conf-authhosts" splunk_server=local | fields + url | rename url as management | sentineloneapi activity_types

Monitoring Console Health Checks

SentinelOne includes the following health checks in the Monitoring Console health check list(default/checklist.conf).

SentinelOne_HealthCheck
Provides basic Yes/No if there is SentinelOne data present.

Legacy Data

This extension introduces new sourcetypes that are more inline with best practices. If the extension is being upgraded from an existing version of the SentinelOne app, these instructions can be followed to allow "overlap" of the data sources. Each of the different sourcetypes will follow the same procedure to enable searching on the old data, concurrent with the new data.

The steps are as follows, and should be done in local/eventtypes.conf:

Update and enable the legacy index event type sentinelone_legacy_index with the index that contains the legacy data.

Agents

Update and enable the sentinelone_legacy_agents event type.
Add sentinelone_legacy_agents to the sentinelone_agents event type
eventtype IN (sentinelone_updated_agents, sentinelone_legacy_agents)

Threats

Update and enable the sentinelone_legacy_threats event type.
Add sentinelone_legacy_threats to the sentinelone_threats event type
eventtype IN (sentinelone_updated_threats, sentinelone_legacy_threats)

Activities

Update and enable the sentinelone_legacy_activities event type.
Add sentinelone_legacy_activities to the sentinelone_activities event type
eventtype IN (sentinelone_updated_activities, sentinelone_legacy_activities)

Groups

Update and enable the sentinelone_legacy_groups event type.
Add sentinelone_legacy_groups to the sentinelone_groups event type
eventtype IN (sentinelone_updated_groups, sentinelone_legacy_groups)

Lookups

The SentinelOne contains the following lookup files.


Transform	Filename	Description
sentinelone_activity_types	sentinelone_activity_types_5.2.0.csv	Describes SentinelOne Activity Types

Scripts and binaries


Diag.py	This is to assist in diag creation for support.
cim_actions.py	Splunk Alert Actions Support script
s1_client.py	Class to allow access to S1 in support of Mod inputs and Alert actions
s1_upgrader.py	Modular input run on startup to check and upgrade the app.
sentinelone.py	Modular Input script file.
AlertAction.py	Helper file for Alert Actions
ModularInput.py	Helper file for Modular Inputs
Utilities.py	Helper file for Utilities
version.py	Technical Version of the app.
sentinelone-network-control.py	This is the script for the Network Control adaptive alert action.
sentinelone-threat-control.py	This is the script for the Threat Control adaptive alert action.
sentinelone_cmd_agent_action.py	This is the script for the Agent Control custom command.
sentinelone_cmd_threat_action.py	This is the script for the Threat Control custom command.
s1_alert_action.py	Class with base Alert Action object
s1_command.py	Class with base Search Command object
s1_utilities.py	Class with specific S1 related utilities
app_properties.py	Dynamically generated to help with multiple classes and loggers
_paths.py	Global import to target `lib` folder.

Event Generator

SentinelOne does not include an event generator.

Acceleration

Summary Indexing: No
Data Model Acceleration: No
Report Acceleration: No

Indexed Fields

There is one indexed field:

siteName

Upgrader

SentinelOne includes an updater to assist in upgrades to the app. It is a modular input with stanza s1_upgrader://DF945543-967A-4488-975E-757F4D5E2B41.

Known Issues

Versions prior to 5.2.0 have the following known issues:

Due to Changes in S1 API parameter enforcement, enhancing inputs with "Threat Events" may cause errors.
Affected S1 Management Consoles: W#91 or newer,

WORKAROUND: This is a code update. In the file s1_client.py, find the line

resp = self.s1_mgmt.threat_explore.get_events(threat_id)

Update this line to read:

resp = self.s1_mgmt.threat_explore.get_events(threat_id, limit=1000)

This will resolve the error, and allow threat event ingest.

Version 5.2.6 of SentinelOne has the following known issues:

If the mgmt_sdk log outputs at any level, the search command will fail with Error in command: Invalid message received from external search command during search, see search.log.
This is only at the final phase of execution. The command most likely functions correctly prior to that.

Installation

Software requirements

Splunk Enterprise system requirements

Because this App runs on Splunk Enterprise, all the Splunk Enterprise system requirements apply.

Download

Download SentinelOne at https://splunkbase.splunk.com/app/5433.

Deployment Guide

Note: Do not install Add-Ons and Apps on the same system.

Single Instance (8.X)
(Pre-requisite) Splunk CIM Add-on
Only the SentinelOne App (sentinelone_app_for_splunk)
Single Instance + Heavy Forwarder (8.X)
Single Instance:
- (Pre-requisite) Splunk CIM Add-on
- SentinelOne App (sentinelone_app_for_splunk)
Heavy Forwarder: IA-sentinelone_app_for_splunk (IA-sentinelone_app_for_splunk)
Distributed deployment (8.x)
Heavy Forwarder: IA-sentinelone_app_for_splunk (IA-sentinelone_app_for_splunk)
Search Head:
- (Pre-requisite) `Splunk CIM Add-on https://splunkbase.splunk.com/app/1621/`_
- SentinelOne App (sentinelone_app_for_splunk)
- Indexer: TA-sentinelone_app_for_splunk (TA-sentinelone_app_for_splunk)

SentinelOne App For Splunk

3