SentinelOne EDR
The Fluency plug-in steps on this page (Adding a Fluency Plug-In for SentinelOne EDR, Updating the API Token and the CloudFunnel plug-in) use the legacy integrations interface. In the current interface, integrations are managed on the Integrations page, under Configuration → Integrations (v1: the Integrations page, opened from View Integrations on Platform → Applications). Install the Application below applies to the current interface.
Fluency's integration with SentinelOne has three portions:
- As a SIEM, Fluency has the ability to accept Syslog export from SentinelOne's cloud portal.
- Fluency can also use SentinelOne's API to collect and tabulate Agents, Applications and Threats information on the Fluency Resources page.
- Lastly, Fluency can ingest and store SentinelOne's CloudFunnel 2.0 (an addtional S1 add-on) feed, to provide deep insight and complete visibility.
Syslog Export: Configuration
The Syslog configuration page is found under the Settings section of the SentinelOne main menu.
Under the Integrations tab, navigate to the Syslog Section.
Toggle Enable Syslog, and complete the Host section of the page.
Syslog Server
The log server address is the designated Syslog URL of your Fluency server.
<company>.syslog.fluencysecurity.com
The default normal Syslog port is UDP 514.
NOTE: The platform's syslog listener settings are under Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports).
Syslog w/ TLS
It is also possible to configure Syslog over TCP with TLS. The port depends on the destination: a collector appliance's tls listener, one you add on its Syslog Ports tab and open in its firewall, is usually on 6514, while the cloud syslog endpoint uses a port allocated to your tenant; read it from Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports).
A Server certificate is required.
NOTE: The CA cert file is downloaded from Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports), whose Download CA (ca.crt) button issues the certificate; see Syslog Ports. If that button is not present on your instance, raise a support ticket.
For all Syslog export methods, the CEF2 format should be selected.
Additionally, the Test button can be used to verify the connection.
Should the above test be successful, click Save to complete the Syslog configuration.
Note: the Syslog setting can be configured either 'per site' or 'per account' in the SentinelOne portal.
Choose the appropriate scope for your deployment.
Syslog Notifications
The notification settings may need to be configured for Syslog. Navigate back to the the Settings section of the SentinelOne main menu, and choose the Notifications tab.
Note: Examine the Syslog column and select as many type as appropriate for your deployment.
Fluency suggests selecting *ALL* event types, whenever possible.
API Integration
An API token from the SentinelOne portal is used by Fluency to provide API integration.
There are two methods to get an API token:
- via an existing user, or
- via a dedicated service account.
Existing User
To get an API token (attached to an existing user), select the User name, and choose My User in the upper right corner of the portal.
The dis-advantage of using an API token attached to an existing user is a shorter expiration time.
A user's API token will expire in 180 days
On this page, you can choose an option from the Actions dropdown to create or regenerate a new API token.
Copy the shown API Token on the next page, and save it for use in Fluency.
Dedicated Service Account
To create a dedicated service account, navigate to the Settings section of the SentinelOne main menu. Under the Users tab, navigate to the Service Users Section.
The Service User will allow API tokens to have a much longer Expiration Date.
On this page, you can choose an option from the Actions dropdown to create a new user.
Fill in the appropriate fields and choose Next to continue.
It is suggested to choose a longest expiration period allowable / possible.
On the following page, select the appropriate Scope (account/site) for your use case.
This API token will only require the Viewer permission, as the Fluency integration is read-only.
Copy the shown API Token on the next page, and save it for use in Fluency.
Install the Application
- v2 interface
- Classic v1 interface
In the navigation rail, open Applications and click Install Application, then choose SentinelOne API Integration from the Endpoint Management category of the Application Catalog.
Go to Platform → Applications → Install Application From Template and choose SentinelOne API Integration from the Endpoint Management category.
| Parameter | Notes |
|---|---|
| Console Base URL | The management console host for your tenant. |
| API Token | The token issued to the console user or service user the integration runs as. Masked once the application is installed. |
| Account IDs (leave empty for all accounts) | Optional, a multi-line box. The SentinelOne account IDs to collect from; left empty, the template collects from every account the token can see. |
| Site IDs (leave empty for all sites) | Optional, a multi-line box. The site IDs to collect from; left empty, the template collects from every site the token can see. |
| datalake | Pre-filled managed. |
| datalake index name | Pre-filled SentinelOne. Two applications writing to the same index name in the same lake will collide, and the second one aborts. |
- v2 interface
- Classic v1 interface
The last two sit in the collapsed Advanced configuration section below Configuration; click its heading to reach them.
Click Dry run first to have the platform check the console URL and the token before anything is installed, then click Install Application. The Applications page opens with the notice Default is launching., and the new application is listed with a green Running badge once the pipeline is up.
The last two sit in the collapsed Advanced Configurations row below the parameters.
Press Install. The application then appears in the Installed Applications view, where its badge reads Running once the pipeline is up.
The template's description reads SentinelOne EDR Activity / Theats / Alerts and Resource Dump (the misspelling is the interface's own): four feeds. Alerts and the resource dump are collected by this template as well as activity and threats, and the install creates two plugin data sources rather than one. Both are visible in the application's pipeline diagram and in the Actions list of its details.
The resource dump is the half that populates the SentinelOne roster on the Resources page (v1: SIEM → Resources), and it is the better health check of the two: a device roster is never legitimately empty on a tenant with agents deployed, where an alert feed can be quiet for a day. If events arrive and the SentinelOne roster on Resources is empty, the token is reaching the console but does not carry the permissions the roster call needs.
The template covers the API integration only. The Syslog export and Cloud Funnel portions of this page have no template and are configured separately.
Adding a Fluency Plug-In for SentinelOne EDR
Sign in to your Fluency portal at https://<companyname>.app.ingext.io; see Fluency Web Interface for the URL formats.
- v2 interface
- Classic v1 interface
In the navigation rail, open Configuration and choose Integrations.
Open Platform → Applications in the navigation bar and click View Integrations.
The "Sentinel One" icon is found under the section "Endpoint Management" in the second tab, "Available Integrations".
To add a new Sentinel One integration, click the "+" in the upper left corner, then you'll see a window on the left as below:
Click the "Save" button to add the connector. You can see it under the "Endpoint Management" section of the first tab "Existing Integrations".
Updating the API Token
In the first tab "Available Integrations", navigate to the Endpoint Management section, find the existing SentinelOne integration on the right side of the page.
Click the icon to view the integration.
Cloud Funnel 2.0
If available, the Cloud Funnel configuration page is found under the Settings section of the SentinelOne main menu.
Under the Integrations tab, navigate to the Cloud Funnel Section.
Please contact Fluency Support to request a dedicated S3 bucket address for your S1 Cloud Funnel integration.
Use the following link to: Create a Support Ticket
It is also possible (but not suggested) to use your own, existing bucket for this integration. Please reach out to Fluency Support if you have this need.
Once you have recieved your S3 bucket address from Fluency support, click Validate to validate the connection, and then click Save.
Adding a Fluency Plug-In for SentinelOne EDR w/ CloudFunnel
Sign in to your Fluency portal at https://<companyname>.app.ingext.io; see Fluency Web Interface for the URL formats.
Follow the instructions in the section above to start adding an integration.
Please contact Fluency Support if you did not receive this information at the same time as your dedicated S3 bucket address.