topic How can I integrate Splunk with Sentinel ONE? in All Apps and Add-ons

How can I integrate Splunk with Sentinel ONE?

fhirata1 — Fri, 22 Jul 2022 15:00:57 GMT

Does anyone know how I can integrate sentinel one with splunk?

Is there any documentation I can follow or something?

Thank you.

Re: Splunk integration with Sentinel ONE

richgalloway — Fri, 22 Jul 2022 14:59:18 GMT

There are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.

Look for a splunkbase add-on for the product. It may explain how to integrate and should help extract fields. There are a few such add-ons for Sentinel One.

Re: How can I integrate Splunk with Sentinel ONE?

fhirata1 — Tue, 26 Jul 2022 19:07:35 GMT

Hello Rich.

Thank you for your answer.

But I need to know how I do the integration with Splunk Cloud.

I follow this link: file:///C:/Users/ze00230/Desktop/Nova%20pasta/Splunk_and_SentinelOne_Integration_v3.6-en.pdf

but it didn't work.

I created the user in the sentinel one panel, generated the api token, put it inside the Sentinel One app, but it is not working.

When I searchfor the word "sentinel" within Splunk it appears Internal logs, as shown in the image.

What could I be doing wrong? Could you please help me ?

Thank you.

Re: How can I integrate Splunk with Sentinel ONE?

richgalloway — Wed, 27 Jul 2022 12:17:36 GMT

The OP didn't mention Splunk Cloud, but the options in my first reply still apply.

Please explain what "it didn't work" means. What results did you get and how do they not meet expectations? What error messages do you get?

That "sentinel" appears in the internal logs indicates there may be errors. What do the logs say?