Collect SentinelOne Cloud Funnel logs

This document describes how you can export SentinelOne Cloud Funnel logs by setting up a Google Security Operations feed and how log fields map to Google Security Operations Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google Security Operations overview .

A typical deployment consists of SentinelOne Cloud Funnel and the Google Security Operations feed configured to send logs to Google Security Operations. Each customer deployment can differ and might be more complex.

The deployment contains the following components:

• SentinelOne: The platform from which you collect logs.

• Google Security Operations feed: The Google Security Operations feed that fetches logs from SentinelOne and writes logs to Google Security Operations.

• Google Security Operations: Retains and analyzes the logs.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the SENTINELONE_CF ingestion label.

Before you begin

Ensure you have the following prerequisites:

• An active Singularity Complete subscription for SentinelOne. Refer to Platform Packages for additional details.
• An active license for the Cloud Funnel Data Lake Streaming Module.
• SentinelOne Cloud Funnel v2.0
• An Admin role for the Global or Account level. To get an Admin role, contact your administrator user.
• Administrator rights to install the SentinelOne agent. To get administrator rights, contact your administrator user.
• A configured Google Cloud Storage Bucket. For more information, see Configure Your Google Cloud Storage Bucket .
  • Replace YOUR_CONSOLE_DOMAIN in the URL with your specific console domain.

Set up SentinelOne Cloud Funnel

1. Sign in to the SentinelOne management console.
2. In the Settingstoolbar, click Integrations > Cloud Funnel.
3. In the Cloud Providerlist, select Google Cloud.
4. In the GCS Storage Namefield, enter the name of the Cloud Storage bucket.
5. Click Validateto validate whether the bucket exists, and that SentinelOne has read and write access to the bucket.
6. Select Enable Telemetry Streamingto stream your XDR data to your bucket.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New
• Content Hub > Content Packs > Get Started

How to set up the SentinelOne Singularity Cloud Funnel feed

1. Click the SentinelOnepack.
2. Click the SentinelOne Singularity Cloud Funnellog type.

3. Specify the values for the following fields:

   • Source type: Google Cloud Storage V2.
   • Storage bucket URI: The Google Cloud Storage bucket source URI.
   • Source deletion option: Whether to delete files or directories after transferring. Select the Delete transferred filesoption in Source deletion option.
   • Maximum File Age: Include files modified within the last number of days. Default is 180 days.
   • Chronicle Service Account: Copy the Service Account. You'll need it to add permissions in the bucket for this Service Account to let Google SecOps read or delete data in the bucket.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

4. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product .

On the Google Cloud Storage Bucket, to add Storage Object Adminor Storage Object Userpermissions to this Service Account, follow these steps:

1. In your Google Cloud console, go to Bucketsand select the bucket name.

2. In Bucket Details, go to Permissions > Grant Access.

3. In New Principles, paste Service Accountthat you copied.

4. In Select a role, select Cloud Storage, then select Storage Object Adminor Storage Object Userrole.

5. Click Nextand then click Submit.

Supported SentinelOne Cloud Funnel log formats

The SentinelOne Cloud Funnel parser supports logs in JSON format.

Supported SentinelOne Cloud Funnel sample logs

• JSON

   {
    "src.process.parent.isStorylineRoot": true,
    "event.category": "group",
    "src.process.parent.image.sha1": "2d79a17a7f226b4a3bc25d47d73570f9a33aac1a",
    "site.id": "767524645468373018",
    "src.process.parent.displayName": "Services and Controller app",
    "src.process.image.binaryIsExecutable": true,
    "src.process.parent.subsystem": "SYS_WIN32",
    "src.process.user": "NT AUTHORITY\\\\SYSTEM",
    "src.process.indicatorRansomwareCount": 0,
    "src.process.crossProcessDupRemoteProcessHandleCount": 0,
    "src.process.tgtFileCreationCount": 0,
    "src.process.indicatorInjectionCount": 0,
    "src.process.moduleCount": 121,
    "i.version": "preprocess-lib-1.0",
    "src.process.parent.name": "services.exe",
    "src.process.image.md5": "b7f884c1b74a263f746ee12a5f7c9f6a",
    "src.process.indicatorReconnaissanceCount": 0,
    "src.process.storyline.id": "93CD8594B971B84A",
    "src.process.childProcCount": 0,
    "mgmt.url": "euce1-dummy.xyz.net",
    "src.process.crossProcessOpenProcessCount": 0,
    "src.process.subsystem": "SYS_WIN32",
    "meta.event.name": "GROUPCREATION",
    "src.process.parent.integrityLevel": "SYSTEM",
    "src.process.indicatorExploitationCount": 0,
    "src.process.parent.storyline.id": "31E78494B971B84A",
    "i.scheme": "edr",
    "src.process.integrityLevel": "SYSTEM",
    "site.name": "Dummy Corp",
    "src.process.netConnInCount": 0,
    "event.time": 1692575814995,
    "timestamp": "2023-08-20T23:56:54.995Z",
    "account.id": "767524645367709720",
    "dataSource.name": "SentinelOne",
    "endpoint.name": "Dummy Endpoint",
    "src.process.image.sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1",
    "src.process.isStorylineRoot": true,
    "src.process.parent.image.path": "C:\\\\windows\\\\System32\\\\services.exe",
    "dataSource.vendor": "SentinelOne",
    "src.process.pid": 21760,
    "tgt.file.isSigned": "signed",
    "dataSource.category": "security",
    "src.process.cmdline": "C:\\\\windows\\\\system32\\\\svchost.exe -k netsvcs -p -s wlidsvc",
    "src.process.publisher": "MICROSOFT WINDOWS",
    "src.process.crossProcessThreadCreateCount": 0,
    "src.process.parent.isNative64Bit": false,
    "src.process.parent.isRedirectCmdProcessor": false,
    "src.process.crossProcessCount": 0,
    "src.process.signedStatus": "signed",
    "event.id": "01H8B5MR9QQEYRC77NV97T2PR0_468",
    "src.process.parent.cmdline": "C:\\\\windows\\\\system32\\\\services.exe",
    "src.process.image.path": "C:\\\\windows\\\\System32\\\\svchost.exe",
    "src.process.tgtFileModificationCount": 0,
    "src.process.indicatorEvasionCount": 0,
    "src.process.netConnOutCount": 2,
    "src.process.crossProcessDupThreadHandleCount": 0,
    "endpoint.os": "windows",
    "src.process.tgtFileDeletionCount": 0,
    "src.process.startTime": 1692575814987,
    "mgmt.id": "12277",
    "os.name": "Windows 10 Enterprise",
    "src.process.displayName": "Host Process for Windows Services",
    "src.process.parent.sessionId": 0,
    "src.process.isNative64Bit": false,
    "src.process.uid": "92CD8594B971B84A",
    "src.process.parent.image.md5": "14b88ff4833012512278a5f3a5712bd2",
    "src.process.indicatorBootConfigurationUpdateCount": 0,
    "src.process.indicatorInfostealerCount": 20,
    "process.unique.key": "92CD8594B971B84A",
    "agent.version": "22.2.4.558",
    "src.process.parent.uid": "30E78494B971B84A",
    "src.process.parent.image.sha256": "e6fe9a94e8686e957dbcec2b89c1c1ddcf8e75d76e9200d0cbef74d510c71317",
    "src.process.sessionId": 0,
    "src.process.netConnCount": 2,
    "mgmt.osRevision": "19045",
    "group.id": "93CD8594B971B84A",
    "src.process.parent.publisher": "MICROSOFT WINDOWS PUBLISHER",
    "src.process.isRedirectCmdProcessor": false,
    "src.process.verifiedStatus": "verified",
    "src.process.parent.startTime": 1692333530832,
    "src.process.dnsCount": 4,
    "endpoint.type": "laptop",
    "trace.id": "01H8B5MR9QQEYRC77NV97T2PR0",
    "src.process.name": "svchost.exe",
    "agent.uuid": "615151318b7b4f8fb4fa1d1b28b7ad0f",
    "src.process.image.sha256": "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88",
    "src.process.indicatorGeneralCount": 8,
    "src.process.crossProcessOutOfStorylineCount": 0,
    "packet.id": "80BC84D0E056415C91A410DDA4B523CD",
    "src.process.registryChangeCount": 0,
    "src.process.indicatorPersistenceCount": 0,
    "src.process.parent.signedStatus": "signed",
    "src.process.parent.user": "NT AUTHORITY\\\\SYSTEM",
    "event.type": "Group Creation",
    "src.process.indicatorPostExploitationCount": 0,
    "src.process.parent.pid": 1568
  } 
  

Supported SentinelOne Cloud Funnel log types

The SentinelOne Cloud Funnel parser supports the following log types:

Set up feeds from the Content Hub

Specify values for the following fields:

• Storage bucket URI: The Google Cloud Storage bucket source URI.
• URI is a: Select the URI TYPE according to log stream configuration ( Single file| Directory| Directory which includes subdirectories).
• Source deletion options: Select the deletion option according to your ingestion preferences.

Advanced options

• Feed Name: A prepopulated value that identifies the feed.
• Source Type: Method used to collect logs into Google SecOps.
• Asset Namespace: Namespace associated with the feed .
• Ingestion Labels: Labels applied to all events from this feed.

Field mapping reference

This section explains how the Google Security Operations parser maps SentinelOne fields to Google Security Operations Unified Data Model (UDM) fields.

Field mapping reference: Event Identifier to Event Type

Field mapping reference: SENTINELONE_CF

The following table lists the log fields of the SENTINELONE_CF log type and their corresponding UDM fields.

What's next

• Data ingestion to Google Security Operations

Need more help? Get answers from Community members and Google SecOps professionals.