Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/sentinel_one/_dev/build/docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -217,4 +217,4 @@ This integration dataset uses the following APIs:

#### ILM Policy

To facilitate application, application risk, and threat event data, source data stream-backed indices `.ds-logs-sentinel_one.application-*`, `.ds-logs-sentinel_one.application_risk-*`, and `.ds-logs-sentinel_one.threat_event-*` are allowed to contain duplicates from each polling interval. ILM policy `logs-sentinel_one.application-default_policy`, `logs-sentinel_one.application_risk-default_policy`, and `logs-sentinel_one.threat_event-default_policy` is added to these source indices, so it doesn't lead to unbounded growth. This means that in these source indices data will be deleted after `30 days` from ingested date.
To facilitate application, application risk, and threat event data, source data stream-backed indices `.ds-logs-sentinel_one.application-*`, `.ds-logs-sentinel_one.application_risk-*`, `.ds-logs-sentinel_one.threat_event-*`, and `.ds-logs-sentinel_one.unified_alert-*` are allowed to contain duplicates from each polling interval. ILM policy `logs-sentinel_one.application-default_policy`, `logs-sentinel_one.application_risk-default_policy`, `logs-sentinel_one.threat_event-default_policy`, and `logs-sentinel_one.unified_alert-default_policy` is added to these source indices, so it doesn't lead to unbounded growth. This means that in these source indices data will be deleted after `30 days` from ingested date.
5 changes: 5 additions & 0 deletions packages/sentinel_one/changelog.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.5.0"
changes:
- description: Add ILM Policy for unified alert data stream.
type: enhancement
link: https://github.com/elastic/integrations/pull/17964
- version: "2.4.1"
changes:
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
Expand Down
18 changes: 9 additions & 9 deletions packages/sentinel_one/data_stream/activity/sample_event.json
Original file line number Diff line number Diff line change
@@ -1,34 +1,34 @@
{
"@timestamp": "2022-04-19T05:14:08.925Z",
"agent": {
"ephemeral_id": "4e254d16-f629-4294-92c4-5d8a111b967d",
"id": "20009a1a-7327-492c-9ebe-fd9f6b9f14dc",
"name": "elastic-agent-97692",
"ephemeral_id": "387e8cd8-1625-44fc-be9c-a1ff32a59043",
"id": "735a54fe-ead0-4e73-8294-cc72abebaac6",
"name": "elastic-agent-30231",
"type": "filebeat",
"version": "8.19.7"
"version": "8.19.13"
},
"data_stream": {
"dataset": "sentinel_one.activity",
"namespace": "12418",
"namespace": "10967",
"type": "logs"
},
"ecs": {
"version": "9.3.0"
},
"elastic_agent": {
"id": "20009a1a-7327-492c-9ebe-fd9f6b9f14dc",
"id": "735a54fe-ead0-4e73-8294-cc72abebaac6",
"snapshot": false,
"version": "8.19.7"
"version": "8.19.13"
},
"event": {
"agent_id_status": "verified",
"category": [
"configuration"
],
"created": "2026-02-10T14:28:38.358Z",
"created": "2026-03-23T06:36:42.764Z",
"dataset": "sentinel_one.activity",
"id": "1234567890123456789",
"ingested": "2026-02-10T14:28:41Z",
"ingested": "2026-03-23T06:36:45Z",
"kind": "event",
"original": "{\"accountId\":\"3214567890123456789\",\"accountName\":\"Default12\",\"activityType\":1234,\"agentId\":null,\"agentUpdatedVersion\":null,\"comments\":\"True\",\"createdAt\":\"2022-04-19T05:14:08.925421Z\",\"data\":{\"accountName\":\"Default\",\"byUser\":\"API\",\"fullScopeDetails\":\"Account Default\",\"fullScopeDetailsPath\":\"test/default\",\"groupName\":null,\"newValue\":true,\"role\":\"Level\",\"scopeLevel\":\"Account\",\"scopeName\":\"Default\",\"siteName\":null,\"userScope\":\"account\",\"username\":\"API\"},\"description\":\"API\",\"groupId\":null,\"groupName\":null,\"hash\":null,\"id\":\"1234567890123456789\",\"osFamily\":null,\"primaryDescription\":\"The management user API enabled Two factor authentication on the user API.\",\"secondaryDescription\":null,\"siteId\":null,\"siteName\":null,\"threatId\":null,\"updatedAt\":\"2022-04-18T05:14:08.922553Z\",\"userId\":\"1234567890123456789\"}",
"type": [
Expand Down
18 changes: 9 additions & 9 deletions packages/sentinel_one/data_stream/agent/sample_event.json
Original file line number Diff line number Diff line change
@@ -1,34 +1,34 @@
{
"@timestamp": "2022-04-07T08:31:47.481Z",
"agent": {
"ephemeral_id": "e7760e98-b3a5-4573-b90b-4156a185ff7e",
"id": "6b519af8-5f8a-499c-a952-8afd527f5e46",
"name": "elastic-agent-68989",
"ephemeral_id": "d7f4d2f4-2ee0-4cbe-9ef6-3c6cb3ed4d25",
"id": "2c180697-37f4-458d-991b-f670698d8036",
"name": "elastic-agent-14579",
"type": "filebeat",
"version": "8.19.7"
"version": "8.19.13"
},
"data_stream": {
"dataset": "sentinel_one.agent",
"namespace": "86084",
"namespace": "75577",
"type": "logs"
},
"ecs": {
"version": "9.3.0"
},
"elastic_agent": {
"id": "6b519af8-5f8a-499c-a952-8afd527f5e46",
"id": "2c180697-37f4-458d-991b-f670698d8036",
"snapshot": false,
"version": "8.19.7"
"version": "8.19.13"
},
"event": {
"agent_id_status": "verified",
"category": [
"host"
],
"created": "2026-02-10T14:29:25.192Z",
"created": "2026-03-23T06:37:31.049Z",
"dataset": "sentinel_one.agent",
"id": "13491234512345",
"ingested": "2026-02-10T14:29:28Z",
"ingested": "2026-03-23T06:37:34Z",
"kind": "event",
"original": "{\"accountId\":\"892341123451234512345\",\"accountName\":\"ABC\",\"activeDirectory\":{\"computerDistinguishedName\":null,\"computerMemberOf\":[],\"lastUserDistinguishedName\":null,\"lastUserMemberOf\":[]},\"activeThreats\":7,\"agentVersion\":\"12.x.x.x\",\"allowRemoteShell\":true,\"appsVulnerabilityStatus\":\"not_applicable\",\"cloudProviders\":{},\"computerName\":\"user-test\",\"consoleMigrationStatus\":\"N/A\",\"coreCount\":2,\"cpuCount\":2,\"cpuId\":\"CPU Name\",\"createdAt\":\"2022-03-18T09:12:00.519500Z\",\"detectionState\":null,\"domain\":\"WORKGROUP\",\"encryptedApplications\":false,\"externalId\":\"\",\"externalIp\":\"81.2.69.143\",\"firewallEnabled\":true,\"firstFullModeTime\":null,\"groupId\":\"1234567890123456789\",\"groupIp\":\"81.2.69.144\",\"groupName\":\"Default Group\",\"id\":\"13491234512345\",\"inRemoteShellSession\":false,\"infected\":true,\"installerType\":\".msi\",\"isActive\":true,\"isDecommissioned\":false,\"isPendingUninstall\":false,\"isUninstalled\":false,\"isUpToDate\":true,\"lastActiveDate\":\"2022-03-17T09:51:28.506000Z\",\"lastIpToMgmt\":\"81.2.69.145\",\"lastLoggedInUserName\":\"\",\"licenseKey\":\"\",\"locationEnabled\":true,\"locationType\":\"not_applicable\",\"locations\":null,\"machineType\":\"server\",\"missingPermissions\":[\"user-action-needed-bluetooth-per\",\"user_action_needed_fda\"],\"mitigationMode\":\"detect\",\"mitigationModeSuspicious\":\"detect\",\"modelName\":\"Compute Engine\",\"networkInterfaces\":[{\"gatewayIp\":\"81.2.69.145\",\"gatewayMacAddress\":\"00-00-5E-00-53-00\",\"id\":\"1234567890123456789\",\"inet\":[\"81.2.69.144\"],\"inet6\":[\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\"],\"name\":\"Ethernet\",\"physical\":\"00-00-5E-00-53-00\"}],\"networkQuarantineEnabled\":false,\"networkStatus\":\"connected\",\"operationalState\":\"na\",\"operationalStateExpiration\":null,\"osArch\":\"64 bit\",\"osName\":\"Linux Server\",\"osRevision\":\"1234\",\"osStartTime\":\"2022-04-06T08:27:14Z\",\"osType\":\"linux\",\"osUsername\":null,\"rangerStatus\":\"Enabled\",\"rangerVersion\":\"21.x.x.x\",\"registeredAt\":\"2022-04-06T08:26:45.515278Z\",\"remoteProfilingState\":\"disabled\",\"remoteProfilingStateExpiration\":null,\"scanAbortedAt\":null,\"scanFinishedAt\":\"2022-04-06T09:18:21.090855Z\",\"scanStartedAt\":\"2022-04-06T08:26:52.838047Z\",\"scanStatus\":\"finished\",\"siteId\":\"1234567890123456789\",\"siteName\":\"Default site\",\"storageName\":null,\"storageType\":null,\"tags\":{\"sentinelone\":[{\"assignedAt\":\"2018-02-27T04:49:26.257525Z\",\"assignedBy\":\"test-user\",\"assignedById\":\"123456789012345678\",\"id\":\"123456789012345678\",\"key\":\"key123\",\"value\":\"value123\"}]},\"threatRebootRequired\":false,\"totalMemory\":1234,\"updatedAt\":\"2022-04-07T08:31:47.481227Z\",\"userActionsNeeded\":[\"reboot_needed\"],\"uuid\":\"XXX35XXX8Xfb4aX0X1X8X12X343X8X30\"}",
"type": [
Expand Down
18 changes: 9 additions & 9 deletions packages/sentinel_one/data_stream/alert/sample_event.json
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{
"@timestamp": "2018-02-27T04:49:26.257Z",
"agent": {
"ephemeral_id": "804e4739-61c2-4fa0-89ef-e62ccf3058e6",
"id": "0024ba0f-ff9f-477c-a98a-9fd558a77fad",
"name": "elastic-agent-15151",
"ephemeral_id": "9499065d-7e92-4b66-9a41-e29e005b7d53",
"id": "17709dec-2bb2-4049-b63a-7cc00e6079fe",
"name": "elastic-agent-48285",
"type": "filebeat",
"version": "8.19.7"
"version": "8.19.13"
},
"container": {
"id": "string",
Expand All @@ -16,7 +16,7 @@
},
"data_stream": {
"dataset": "sentinel_one.alert",
"namespace": "25003",
"namespace": "73436",
"type": "logs"
},
"destination": {
Expand All @@ -38,19 +38,19 @@
"version": "9.3.0"
},
"elastic_agent": {
"id": "0024ba0f-ff9f-477c-a98a-9fd558a77fad",
"id": "17709dec-2bb2-4049-b63a-7cc00e6079fe",
"snapshot": false,
"version": "8.19.7"
"version": "8.19.13"
},
"event": {
"agent_id_status": "verified",
"category": [
"malware"
],
"created": "2026-02-10T14:30:05.453Z",
"created": "2026-03-23T06:38:20.172Z",
"dataset": "sentinel_one.alert",
"id": "888456789123456789",
"ingested": "2026-02-10T14:30:08Z",
"ingested": "2026-03-23T06:38:23Z",
"kind": "event",
"original": "{\"agentDetectionInfo\":{\"machineType\":\"string\",\"name\":\"string\",\"osFamily\":\"string\",\"osName\":\"string\",\"osRevision\":\"string\",\"siteId\":\"123456789123456789\",\"uuid\":\"string\",\"version\":\"3.x.x.x\"},\"alertInfo\":{\"alertId\":\"888456789123456789\",\"analystVerdict\":\"string\",\"createdAt\":\"2018-02-27T04:49:26.257525Z\",\"dnsRequest\":\"string\",\"dnsResponse\":\"string\",\"dstIp\":\"81.2.69.144\",\"dstPort\":\"1234\",\"dvEventId\":\"string\",\"eventType\":\"info\",\"hitType\":\"Events\",\"incidentStatus\":\"open\",\"indicatorCategory\":\"string\",\"indicatorDescription\":\"string\",\"indicatorName\":\"string\",\"loginAccountDomain\":\"string\",\"loginAccountSid\":\"string\",\"loginIsAdministratorEquivalent\":\"string\",\"loginIsSuccessful\":\"string\",\"loginType\":\"login\",\"loginsUserName\":\"string\",\"modulePath\":\"string\",\"moduleSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"netEventDirection\":\"string\",\"registryKeyPath\":\"string\",\"registryOldValue\":\"string\",\"registryOldValueType\":\"string\",\"registryPath\":\"string\",\"registryValue\":\"string\",\"reportedAt\":\"2018-02-27T04:49:26.257525Z\",\"source\":\"string\",\"srcIp\":\"81.2.69.142\",\"srcMachineIp\":\"81.2.69.142\",\"srcPort\":\"1234\",\"tiIndicatorComparisonMethod\":\"string\",\"tiIndicatorSource\":\"string\",\"tiIndicatorType\":\"string\",\"tiIndicatorValue\":\"string\",\"updatedAt\":\"2018-02-27T04:49:26.257525Z\"},\"containerInfo\":{\"id\":\"string\",\"image\":\"string\",\"labels\":\"string\",\"name\":\"string\"},\"kubernetesInfo\":{\"cluster\":\"string\",\"controllerKind\":\"string\",\"controllerLabels\":\"string\",\"controllerName\":\"string\",\"namespace\":\"string\",\"namespaceLabels\":\"string\",\"node\":\"string\",\"pod\":\"string\",\"podLabels\":\"string\"},\"ruleInfo\":{\"description\":\"string\",\"id\":\"string\",\"name\":\"string\",\"scopeLevel\":\"string\",\"severity\":\"Low\",\"treatAsThreat\":\"UNDEFINED\"},\"sourceParentProcessInfo\":{\"commandline\":\"string\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"integrityLevel\":\"unknown\",\"name\":\"string\",\"pid\":\"12345\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"subsystem\":\"unknown\",\"uniqueId\":\"string\",\"user\":\"string\"},\"sourceProcessInfo\":{\"commandline\":\"string\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"integrityLevel\":\"unknown\",\"name\":\"string\",\"pid\":\"12345\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"subsystem\":\"unknown\",\"uniqueId\":\"string\",\"user\":\"string\"},\"targetProcessInfo\":{\"tgtFileCreatedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"tgtFileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"tgtFileId\":\"string\",\"tgtFileIsSigned\":\"string\",\"tgtFileModifiedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileOldPath\":\"string\",\"tgtFilePath\":\"string\",\"tgtProcCmdLine\":\"string\",\"tgtProcImagePath\":\"string\",\"tgtProcIntegrityLevel\":\"unknown\",\"tgtProcName\":\"string\",\"tgtProcPid\":\"12345\",\"tgtProcSignedStatus\":\"string\",\"tgtProcStorylineId\":\"string\",\"tgtProcUid\":\"string\",\"tgtProcessStartTime\":\"2018-02-27T04:49:26.257525Z\"}}",
"severity": 21,
Expand Down
Original file line number Diff line number Diff line change
@@ -1,24 +1,24 @@
{
"@timestamp": "2026-02-10T14:30:45.804Z",
"@timestamp": "2026-03-23T06:39:01.440Z",
"agent": {
"ephemeral_id": "0c6b830d-8ee7-415c-b3d8-a50717517cc3",
"id": "78a37c9e-11b5-4847-a57d-22f9f3167948",
"name": "elastic-agent-72525",
"ephemeral_id": "a79a7d63-952c-4688-92bd-b409c04a42e0",
"id": "0e8a5b56-ad0e-49ed-b8e1-5910b7436336",
"name": "elastic-agent-93942",
"type": "filebeat",
"version": "8.19.7"
"version": "8.19.13"
},
"data_stream": {
"dataset": "sentinel_one.application",
"namespace": "72563",
"namespace": "41745",
"type": "logs"
},
"ecs": {
"version": "9.3.0"
},
"elastic_agent": {
"id": "78a37c9e-11b5-4847-a57d-22f9f3167948",
"id": "0e8a5b56-ad0e-49ed-b8e1-5910b7436336",
"snapshot": false,
"version": "8.19.7"
"version": "8.19.13"
},
"event": {
"agent_id_status": "verified",
Expand All @@ -27,7 +27,7 @@
],
"dataset": "sentinel_one.application",
"id": "2218357748550497214",
"ingested": "2026-02-10T14:30:48Z",
"ingested": "2026-03-23T06:39:04Z",
"kind": "event",
"original": "{\"accountName\":\"7-Zip\",\"applicationInstallationDate\":\"2025-04-13T10:45:01Z\",\"applicationInstallationPath\":null,\"applicationName\":\"Igor Pavlov\",\"coreCount\":2,\"cpe\":\"cpe:2.3:a:abc:igor:8.17.3:*:*:*:*:*:*:*\",\"cpuCount\":1,\"detectionDate\":\"2025-06-19T18:00:51.166610Z\",\"endpointId\":\"216970508828266268\",\"endpointName\":\"srv-win-defend-03\",\"endpointType\":\"server\",\"endpointUuid\":\"eb655be8be894dae97711ebb9a9091ae\",\"fileSize\":517364,\"groupName\":\"Default Group\",\"id\":\"2218357748550497214\",\"osArch\":\"64 bit\",\"osName\":\"Windows Server 2022 Datacenter\",\"osType\":\"windows\",\"osVersion\":\"Windows Server 2022 Datacenter 20348\",\"siteName\":\"Default site\",\"version\":\"8.17.3\"}",
"type": [
Expand Down
Original file line number Diff line number Diff line change
@@ -1,24 +1,24 @@
{
"@timestamp": "2025-07-29T19:25:47.000Z",
"agent": {
"ephemeral_id": "1c04faec-5729-4653-8b05-0b5abcbf3e4e",
"id": "16cef37b-fee6-438a-a1fc-1df8e73bc9ac",
"name": "elastic-agent-56838",
"ephemeral_id": "050bcaaa-9ef9-4ed1-964e-1c33232459a8",
"id": "b2bb5aa6-8fdc-42b0-aef2-afcdb76f6f82",
"name": "elastic-agent-29977",
"type": "filebeat",
"version": "8.19.7"
"version": "8.19.13"
},
"data_stream": {
"dataset": "sentinel_one.application_risk",
"namespace": "44223",
"namespace": "22786",
"type": "logs"
},
"ecs": {
"version": "9.3.0"
},
"elastic_agent": {
"id": "16cef37b-fee6-438a-a1fc-1df8e73bc9ac",
"id": "b2bb5aa6-8fdc-42b0-aef2-afcdb76f6f82",
"snapshot": false,
"version": "8.19.7"
"version": "8.19.13"
},
"event": {
"agent_id_status": "verified",
Expand All @@ -28,7 +28,7 @@
"created": "2025-06-02T04:46:51.710Z",
"dataset": "sentinel_one.application_risk",
"id": "2228104980801805822",
"ingested": "2026-02-10T14:31:28Z",
"ingested": "2026-03-23T06:39:53Z",
"kind": "state",
"original": "{\"application\":\"7-Zip 22.01\",\"applicationName\":\"7-Zip\",\"applicationVendor\":\"Igor Pavlov\",\"applicationVersion\":\"22.01\",\"baseScore\":\"7.00\",\"cveId\":\"CVE-2025-0411\",\"cvssVersion\":\"3.1\",\"daysDetected\":59,\"detectionDate\":\"2025-06-02T04:46:51.710569Z\",\"endpointId\":\"2162143406517023959\",\"endpointName\":\"test_endpoint\",\"endpointType\":\"desktop\",\"id\":\"2228104980801805822\",\"lastScanDate\":\"2025-07-29T19:25:47Z\",\"lastScanResult\":\"Succeeded\",\"markType\":\"\",\"markedBy\":null,\"markedDate\":null,\"osType\":\"windows\",\"publishedDate\":\"2025-01-20T07:04:04Z\",\"reason\":null,\"severity\":\"HIGH\",\"status\":\"Detected\"}",
"outcome": "success",
Expand Down
18 changes: 9 additions & 9 deletions packages/sentinel_one/data_stream/group/sample_event.json
Original file line number Diff line number Diff line change
@@ -1,33 +1,33 @@
{
"@timestamp": "2022-04-05T16:01:57.564Z",
"agent": {
"ephemeral_id": "ed2c445a-73ab-4211-8582-ad14acdfd7cf",
"id": "f48922db-e7d0-4df4-ada7-12f6a693230e",
"name": "elastic-agent-95178",
"ephemeral_id": "2aeb274a-01e9-4e3f-874b-976b9494ac24",
"id": "58b2a14c-52df-4c49-8aa5-f523f550c9cc",
"name": "elastic-agent-69832",
"type": "filebeat",
"version": "8.19.7"
"version": "8.19.13"
},
"data_stream": {
"dataset": "sentinel_one.group",
"namespace": "35252",
"namespace": "62299",
"type": "logs"
},
"ecs": {
"version": "9.3.0"
},
"elastic_agent": {
"id": "f48922db-e7d0-4df4-ada7-12f6a693230e",
"id": "58b2a14c-52df-4c49-8aa5-f523f550c9cc",
"snapshot": false,
"version": "8.19.7"
"version": "8.19.13"
},
"event": {
"agent_id_status": "verified",
"category": [
"iam"
],
"created": "2026-02-10T14:32:06.054Z",
"created": "2026-03-23T06:40:40.776Z",
"dataset": "sentinel_one.group",
"ingested": "2026-02-10T14:32:09Z",
"ingested": "2026-03-23T06:40:43Z",
"kind": "event",
"original": "{\"createdAt\":\"2022-04-05T16:01:56.928383Z\",\"creator\":\"Test User\",\"creatorId\":\"1234567890123456789\",\"filterId\":null,\"filterName\":null,\"id\":\"1234567890123456789\",\"inherits\":true,\"isDefault\":true,\"name\":\"Default Group\",\"rank\":null,\"registrationToken\":\"eyxxxxxxxxxxxxxxxxxxxxkixZxx1xxxxx8xxx2xODA0ZxxxxTIwNjhxxxxxxxxxxxxxxiMWYxx1Ixxnxxxx0=\",\"siteId\":\"1234567890123456789\",\"totalAgents\":1,\"type\":\"static\",\"updatedAt\":\"2022-04-05T16:01:57.564266Z\"}",
"type": [
Expand Down
Loading
Loading