Splunk Enterprise

Multiple Indexes - SentinelOne

CyberESIArch
Engager

We have more than one instance of S1 configured in the SentinelOne app on our SH. We do NOT have the S1 TA installed anywhere else. We have noticed that you can only specific a single "SentinelOne Search Index" in the base configuration. We have more than one index because we have configured each instance we have to go to different indexes. Because of this, the only index where events are typed and tagged properly is the index we have selected in the app. 

Anyone know how we can get around this and have the events in the other indexes typed and tagged correctly?

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You may see that the UI is a front end to setting the eventtype and macro configurations called sentinelone_base_index, which have the definition

 

index IN (xx)

 

so you can edit these and add in your indexes

 

index IN (xx,yy)

 

There is also a configuration file, sentinelone_settings.conf, which has a base_index = XX, so not the same as the others, but I am not sure where this is used, if anywhere.

I can't see any obvious usage of the macro, but you could try updating the macro and eventtype to see if that works

aplura_llc_supp
Path Finder

@CyberESIArch:: @bowesmana is correct. Update both the macro and eventtype sentinelone_base_index for searching/typing/tagging to take place correctly. The setting in sentinelone_settings.conf is used to drive the dropdown (and not have to parse the eventtype or macro). It has "the authority" of what is supposed to be configured. You can contact S1 and initiate a feature update request to allow multiple indexes in the dropdown.

0 Karma

CyberESIArch
Engager

I appreciate the response. Updating the macro doesn't seem to make any real difference. I am going to reach out to SentinelOne and see what they have to say, if anything. 

0 Karma

CyberESIArch
Engager

Thanks. I'll take a look. I think I tried modifying that search macro once already. I'll try it again. 

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...