SentinelOne Cloud Funnel

Takes the SentinelOne Cloud Funnel telemetry stream as it arrives and stores it whole. Cloud Funnel already ships structured records, so this recipe extracts nothing: it stamps an arrival timestamp on any record that lacks one, marks the record an event, and passes it on. Use it when you want the full stream retained and intend to query it under the field names SentinelOne itself uses. See SentinelOne for the narrower syslog alert feed.

The Parser

// Description:
// Default system Syslog event passthrough

// Data input format: ({ obj, size }) or ( doc )
function main({obj, size}) {
    //
    if(!obj["@timestamp"]){
        let t = new Time()
        obj["@timestamp"] = t.UnixMilli()
    }
    obj["@type"] = "event"
    obj["@parser"] = "fpl"
    return "pass"
}