About the Device
SentinelOne EDR is an advanced EDR and threat hunting solution that delivers real-time visibility with contextualized, correlated insights accelerating triaging and root cause analysis. SentinelOne's remediation capabilities include quarantining infected files, blocking malicious network connections, and rolling back systems to a pre-attack state.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | SentinelOne |
Product Name | EDR (Endpoint Detection & Response) |
Type of Device | Hosted |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
SentinelOne EDR | SENTINEL_EDR | Syslog - CEF2 | CyberHub |
Port Requirements
Source | Destination | Port |
|---|---|---|
SentinelOne EDR | CyberHub | 6514(TCP) |
Device Configuration
In the SentinelOne management console, at the Account level, navigate to Settings > Notifications
Under Notification Types, select All
Select the Syslog checkbox for each type of Notification.
Once this is completed, in the Settings view, select Integrations.
Under Types, select SYSLOG.
Toggle on the Enable Syslog radio button.
In the Host field enter the CyberHub hostname and port 6514
Select Use TLS secure connection
If this is not selected, UDP is used by default. We recommend to use TLS.
Under Formatting, select CEF2
Select TEST
If the test passed, select SAVE
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
IP Address | SentinelOne EDR interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub |