Multiple Indexes - SentinelOne

[CyberESIArch]

We have more than one instance of S1 configured in the SentinelOne app on our SH. We do NOT have the S1 TA installed anywhere else. We have noticed that you can only specific a single "SentinelOne Search Index" in the base configuration. We have more than one index because we have configured each instance we have to go to different indexes. Because of this, the only index where events are typed and tagged properly is the index we have selected in the app. 

Anyone know how we can get around this and have the events in the other indexes typed and tagged correctly?

[bowesmana]

You may see that the UI is a front end to setting the eventtype and macro configurations called sentinelone_base_index, which have the definition

index IN (xx)

so you can edit these and add in your indexes

index IN (xx,yy)

There is also a configuration file, sentinelone_settings.conf, which has a base_index = XX, so not the same as the others, but I am not sure where this is used, if anywhere.

I can't see any obvious usage of the macro, but you could try updating the macro and eventtype to see if that works

[aplura_llc_supp]

@CyberESIArch:: @bowesmana is correct. Update both the macro and eventtype sentinelone_base_index for searching/typing/tagging to take place correctly. The setting in sentinelone_settings.conf is used to drive the dropdown (and not have to parse the eventtype or macro). It has "the authority" of what is supposed to be configured. You can contact S1 and initiate a feature update request to allow multiple indexes in the dropdown.

[CyberESIArch]

I appreciate the response. Updating the macro doesn't seem to make any real difference. I am going to reach out to SentinelOne and see what they have to say, if anything. 

[CyberESIArch]

Thanks. I'll take a look. I think I tried modifying that search macro once already. I'll try it again.