SentinelOne EDR

1 About the Device
2 Device Information
3 Collection Method
4 Port Requirements
5 Device Configuration
6 Integration Parameters

About the Device

SentinelOne EDR is an advanced EDR and threat hunting solution that delivers real-time visibility with contextualized, correlated insights accelerating triaging and root cause analysis. SentinelOne's remediation capabilities include quarantining infected files, blocking malicious network connections, and rolling back systems to a pre-attack state.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	SentinelOne
Product Name	EDR (Endpoint Detection & Response)
Type of Device	Hosted

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method	Data Source
SentinelOne EDR	SENTINEL_EDR	Syslog - CEF2	CyberHub	NA
Sentinelone Alerts	SENTINELONE_ALERT	API - JSON	C2C	https://cloud.google.com/chronicle/docs/reference/feed-management-api#sentinelone-alert

Port Requirements

Source	Destination	Port

Source	Destination	Port
SentinelOne EDR	CyberHub	6514 (TCP)

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

In the SentinelOne management console, at the Account level, navigate to Settings > Notifications
Under Notification Types, select All
Select the Syslog checkbox for each type of Notification.

In Settings view, select Integrations.
Under Types, select SYSLOG.
Enable Syslog.
In the Host field enter the CyberHub hostname and port 6514.
Select Use TLS secure connection
- If this is not selected, UDP is used by default. We recommend to use TLS.
Under Formatting, select CEF2

Select TEST
If the test passed, select SAVE

Configuration for SentinelOne EDR (Alert)

For log collection we need FQDN name of your SentinelOne API and API Token Key from customer which need to use in sensor configuration.

Pre-requisite: Need a user in the device which has Viewer role assigned.

Log in to Device Management Console, navigate to extreme right corner and click User Name > My User

The following pop up appears

Click Generate API Token.
Copy the API token.

Integration Parameters

Parameters required from customer for Integration.

SentinelOne EDR

Property	Default Value	Description

Property	Default Value	Description
IP Address	SentinelOne EDR interface IP address	Hostname or IP address of the device which forwards logs to the CyberHub

SentienlOne EDR (Alert)

Parameter Display Name	Default Value	Description

Parameter Display Name	Default Value	Description
AUTHENTICATION HTTP HEADERS	N/A	The HTTP header used to authenticate SentinelOne Alerts/Threats & static-indicator API in "key:value" format. Eg- Authorization: ApiToken {apiToken}
API HOSTNAME	N/A	The fully qualified domain name of your SentinelOne API. Eg- xxxx-xxx..sentinelone.net
INITIAL START TIME	N/A	Time since when the alerts should be fetched Eg- 2000-01-01T01:01:01.000001Z
IS ALERT API SUBSCRIBED	N/A	Whether alerts API is subscribed by the customer
ASSET NAMESPACE	N/A	To assign an asset namespace to all events that are ingested from a particular feed, set the `"namespace"` field within `details`. The `namespace` field is a string.