topic Re: Multiple Indexes - SentinelOne in Splunk Enterprise

Multiple Indexes - SentinelOne

CyberESIArch — Fri, 13 Dec 2024 21:11:33 GMT

We have more than one instance of S1 configured in the SentinelOne app on our SH. We do NOT have the S1 TA installed anywhere else. We have noticed that you can only specific a single "SentinelOne Search Index" in the base configuration. We have more than one index because we have configured each instance we have to go to different indexes. Because of this, the only index where events are typed and tagged properly is the index we have selected in the app.

Anyone know how we can get around this and have the events in the other indexes typed and tagged correctly?

Re: Multiple Indexes - SentinelOne

bowesmana — Mon, 16 Dec 2024 00:23:52 GMT

You may see that the UI is a front end to setting the eventtype and macro configurations called sentinelone_base_index, which have the definition

index IN (xx)

so you can edit these and add in your indexes

index IN (xx,yy)

There is also a configuration file, sentinelone_settings.conf, which has a base_index = XX, so not the same as the others, but I am not sure where this is used, if anywhere.

I can't see any obvious usage of the macro, but you could try updating the macro and eventtype to see if that works

Re: Multiple Indexes - SentinelOne

CyberESIArch — Mon, 16 Dec 2024 03:07:37 GMT

Thanks. I'll take a look. I think I tried modifying that search macro once already. I'll try it again.

Re: Multiple Indexes - SentinelOne

CyberESIArch — Mon, 16 Dec 2024 21:40:44 GMT

I appreciate the response. Updating the macro doesn't seem to make any real difference. I am going to reach out to SentinelOne and see what they have to say, if anything.

Re: Multiple Indexes - SentinelOne

aplura_llc_supp — Thu, 02 Jan 2025 15:56:46 GMT

@CyberESIArch:: @bowesmana is correct. Update both the macro and eventtype sentinelone_base_index for searching/typing/tagging to take place correctly. The setting in sentinelone_settings.conf is used to drive the dropdown (and not have to parse the eventtype or macro). It has "the authority" of what is supposed to be configured. You can contact S1 and initiate a feature update request to allow multiple indexes in the dropdown.