All Apps and Add-ons

How can I integrate Splunk with Sentinel ONE?

fhirata1
Engager

Does anyone know how I can integrate sentinel one with splunk?

Is there any documentation I can follow or something?

 

Thank you.

Labels (1)
0 Karma

fhirata1
Engager

Hello Rich.

Thank you for your answer.

But I need to know how I do the integration with Splunk Cloud.

I follow this link:  file:///C:/Users/ze00230/Desktop/Nova%20pasta/Splunk_and_SentinelOne_Integration_v3.6-en.pdf

but it didn't work.

I created the user in the sentinel one panel, generated the api token, put it inside the Sentinel One app, but it is not working.

When I searchfor the word "sentinel" within Splunk it appears Internal logs, as shown in the image.

Captura de tela 2022-07-26 160616.png

What could I be doing wrong? Could you please help me ?

 

Thank you.

 

 

 

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The OP didn't mention Splunk Cloud, but the options in my first reply still apply.

Please explain what "it didn't work" means.  What results did you get and how do they not meet expectations?  What error messages do you get?

That "sentinel" appears in the internal logs indicates there may be errors.  What do the logs say?

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.

Look for a splunkbase add-on for the product.  It may explain how to integrate and should help extract fields.  There are a few such add-ons for Sentinel One.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...