Ingest raw EDR events from SentinelOne DeepVisibility - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Log in to the AWS Management Console and navigate to the S3 Service.

Create a new S3 bucket:

1. Click Create bucket.

2. For Bucket Name, enter a unique name for the bucket (for example, xsiam-s1-edr-data).

3. Choose an appropriate AWS Region.

4. Set Block all public access to Enabled.

5. Click Create bucket.

Set up the Bucket policy:

1. Click the Permissions tab of your new bucket.

2. Under Bucket policy, click Edit and add the following policy to allow SentinelOne DeepVisibility to write data there.

   Replace your-sentinelone-account-id with the relevant value for your environment; replace xsiam-s1-edr-data with the name of your new bucket.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "your-sentinelone-account-id"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::xsiam-s1-edr-data/*"
           }
       ]
   }

In the Amazon SQS Console, click Create Queue.

Configure the following settings, where the default settings should be configured unless otherwise indicated.

Click Create queue.

When the SQS is created, a message indicating that the queue was successfully configured is displayed at the top of the page.

Open the Amazon S3 Console and in the Properties tab of your Amazon S3 bucket, scroll down to the Event notifications section, and click Create event notification.

Configure the following settings:

Click Save changes.

When the event notification is created, a message indicating that the event notification was successfully created is displayed at the top of the page.

Create an IAM Policy that grants permissions for SQS and S3:

1. In the AWS Console, navigate to the IAM service, and click Policies.

2. Click Create policy.

3. Select the JSON policy editor.

4. Use this sample code as a guide for defining the “Statement” with the following definitions:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "S3ReadAccess",
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:ListBucket"
               ],
               "Resource": [
                   "[ARN for the S3 Bucket Name defined by AWS]", #example: "arn:aws:s3:::bucketname/xsiam-s1-edr-data/"
                   "[ARN for the S3 Bucket path defined by AWS]" #example: "arn:aws:s3:::bucketname/xsiam-s1-edr-data/*"
               ]
           },
           {
               "Sid": "SQSReceiveAccess",
               "Effect": "Allow",
               "Action": [
                   "sqs:ReceiveMessage",
                   "sqs:GetQueueAttributes"
               ],
               "Resource": "[ARN for the SQS queue defined by AWS]"
           }
       ]
   }

5. Click Next.

6. For Policy name, enter a name.

7. Click Create policy.

Create an IAM User:

1. In the AWS Console, navigate to the IAM service, and click Users.

2. Click Create user.

3. For User name, enter a name (for example, cortex-xsiam-s3).

4. Attach the IAM Policy that you created in Step 1.

5. Click Next.

6. Click Create user.

Configure access keys for the AWS IAM User:

1. Open the AWS IAM Console, and in the navigation pane, select Access management → Users.

2. Select the User name of the AWS IAM user.

3. Select the Security credentials tab, scroll down to the Access keys section, and click Create access key.

4. Click the copy icon next to the Access key ID and Secret access key keys, where you must click Show secret access key to see the secret key, and save a copy of them somewhere safe before closing the window. You will need to provide these keys when you edit the Access policy of the SQS queue, and when setting the AWS Client ID and AWS Client Secret in Cortex XSIAM. If you forget to record the keys and close the window, you will need to generate new keys and repeat this process.

   Note

   For more information, see Managing access keys for IAM users.

Update the Access policy of your Amazon SQS queue:

1. In the Amazon SQS Console, select the SQS queue that you created when you configured an Amazon Simple Queue Service (SQS).

2. Select the Access policy tab, and click Edit to edit the Access policy code in the editor window, to enable the IAM user to perform operations on the Amazon SQS with the permissions SQS:ChangeMessageVisibility, SQS:DeleteMessage, and SQS:ReceiveMessage. Use this sample code as a guide for defining the “Sid”: “__receiver_statement” with the following definitions.

   • “aws:SourceArn”: Specify the ARN of the AWS IAM user. You can retrieve the User ARN from the Security credentials tab, which you accessed when you configured access keys for the AWS API user.

   • “Resource”: Keep the automatically generated ARN for the SQS queue that is set in the code, which uses the format “arn:sns:Region:account-id:topic-name”.

     Note

     For more information on granting permissions to publish messages to an SQS queue, see Granting permissions to publish event notification messages to a destination.

     {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Principal": {
             "Service": "s3.amazonaws.com"
           },
           "Action": "SQS:SendMessage",
           "Resource": "[Leave automatically generated ARN for the SQS queue defined by AWS]",
           "Condition": {
             "ArnLike": {
               "aws:SourceArn": "[ARN of your Amazon S3 bucket]"
             }
           }
         },
        {
           "Sid": "__receiver_statement",
           "Effect": "Allow",
           "Principal": {
             "AWS": "[Add the ARN for the AWS IAM user]"
           },
           "Action": [
             "SQS:ChangeMessageVisibility",
             "SQS:DeleteMessage",
             "SQS:ReceiveMessage"
           ],
           "Resource": "[Leave automatically generated ARN for the SQS queue defined by AWS]"
         }
       ]
     }

3. Click Save.

In SentinelOne DeepVisibility, select Configure → Policy & Settings and in the Singularity Data Lake section, click Cloud Funnel.

For Cloud Provider, select AWS (Amazon Web Services).

For S3 Bucket Name, enter the name of the Amazon S3 bucket that you created for SentinelOne DeepVisibility log ingestion.

For Telemetry Streaming, select Enable.

In the Query Filters box, create a query that includes the agents that should send data to the S3 bucket.

To validate the query, click Validate.

For Fields to include, ensure that all fields are selected.

Click Save.

In Cortex XSIAM, select Settings → Data Sources.

On the Data Sources page, click Add Data Source, search for and select SentinelOne - Deep Visibility, and click Connect.

Use the toggle to select either Access Key or Assumed Role.

Set these parameters, depending on your choice in the previous step:

Click Test to validate access, and then click Enable.

After events start to come in, a green check mark appears below the SentinelOne - DeepVisibility configuration, along with the amount of data received.