About the Device
SentinelOne EDR is an advanced EDR and threat hunting solution that delivers real-time visibility with contextualized, correlated insights accelerating triaging and root cause analysis. SentinelOne's remediation capabilities include quarantining infected files, blocking malicious network connections, and rolling back systems to a pre-attack state.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | SentinelOne |
Product Name | EDR (Endpoint Detection & Response) |
Type of Device | Hosted |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method | Data Source |
|---|---|---|---|---|
SentinelOne EDR | SENTINEL_EDR | Syslog - CEF2 | CyberHub | NA |
Sentinelone Alerts | SENTINELONE_ALERT | API - JSON | C2C | https://cloud.google.com/chronicle/docs/reference/feed-management-api#sentinelone-alert |
Port Requirements
Source | Destination | Port |
|---|---|---|
SentinelOne EDR | CyberHub | 6514 (TCP) |
To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.
While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.
In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.
Device Configuration
In the SentinelOne management console, at the Account level, navigate to Settings > Notifications
Under Notification Types, select All
Select the Syslog checkbox for each type of Notification.
In Settings view, select Integrations.
Under Types, select SYSLOG.
Enable Syslog.
In the Host field enter the CyberHub hostname and port 6514.
Select Use TLS secure connection
If this is not selected, UDP is used by default. We recommend to use TLS.
Under Formatting, select CEF2
Select TEST
If the test passed, select SAVE
Configuration for SentinelOne EDR (Alert)
For log collection we need FQDN name of your SentinelOne API and API Token Key from customer which need to use in sensor configuration.
Pre-requisite: Need a user in the device which has Viewer role assigned.
Log in to Device Management Console, navigate to extreme right corner and click User Name > My User
The following pop up appears
Click Generate API Token.
Copy the API token.
Integration Parameters
Parameters required from customer for Integration.
SentinelOne EDR
Property | Default Value | Description |
|---|---|---|
IP Address | SentinelOne EDR interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub |
SentienlOne EDR (Alert)
Parameter Display Name | Default Value | Description |
|---|---|---|
AUTHENTICATION HTTP HEADERS | N/A | The HTTP header used to authenticate SentinelOne Alerts/Threats & static-indicator API in "key:value" format. |
API HOSTNAME | N/A | The fully qualified domain name of your SentinelOne API. |
INITIAL START TIME | N/A | Time since when the alerts should be fetched Eg- 2000-01-01T01:01:01.000001Z |
IS ALERT API SUBSCRIBED | N/A | Whether alerts API is subscribed by the customer |
ASSET NAMESPACE | N/A | To assign an asset namespace to all events that are ingested from a particular feed, set the |