Splunk Enterprise

Multiple Indexes - SentinelOne

CyberESIArch
Engager

We have more than one instance of S1 configured in the SentinelOne app on our SH. We do NOT have the S1 TA installed anywhere else. We have noticed that you can only specific a single "SentinelOne Search Index" in the base configuration. We have more than one index because we have configured each instance we have to go to different indexes. Because of this, the only index where events are typed and tagged properly is the index we have selected in the app. 

Anyone know how we can get around this and have the events in the other indexes typed and tagged correctly?

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You may see that the UI is a front end to setting the eventtype and macro configurations called sentinelone_base_index, which have the definition

 

index IN (xx)

 

so you can edit these and add in your indexes

 

index IN (xx,yy)

 

There is also a configuration file, sentinelone_settings.conf, which has a base_index = XX, so not the same as the others, but I am not sure where this is used, if anywhere.

I can't see any obvious usage of the macro, but you could try updating the macro and eventtype to see if that works

CyberESIArch
Engager

I appreciate the response. Updating the macro doesn't seem to make any real difference. I am going to reach out to SentinelOne and see what they have to say, if anything. 

0 Karma

CyberESIArch
Engager

Thanks. I'll take a look. I think I tried modifying that search macro once already. I'll try it again. 

0 Karma
Get Updates on the Splunk Community!

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...