|
| 1 | +[metadata] |
| 2 | +creation_date = "2025/08/04" |
| 3 | +integration = ["sentinel_one"] |
| 4 | +maturity = "production" |
| 5 | +promotion = true |
| 6 | +min_stack_version = "8.18.0" |
| 7 | +min_stack_comments = "Introduced support for SentinelOne threat promotion" |
| 8 | +updated_date = "2025/08/04" |
| 9 | + |
| 10 | +[rule] |
| 11 | +author = ["Elastic"] |
| 12 | +description = """ |
| 13 | +Generates a detection alert for each SentinelOne threat written to the configured indices. Enabling this rule allows you |
| 14 | +to immediately begin investigating SentinelOne threat alerts in the app. |
| 15 | +""" |
| 16 | +from = "now-2m" |
| 17 | +index = ["logs-sentinel_one.threat-*"] |
| 18 | +interval = "1m" |
| 19 | +language = "kuery" |
| 20 | +license = "Elastic License v2" |
| 21 | +max_signals = 1000 |
| 22 | +name = "SentinelOne Threat External Alerts" |
| 23 | +note = """## Triage and analysis |
| 24 | +
|
| 25 | +### Investigating SentinelOne Threat External Alerts |
| 26 | +
|
| 27 | +SentinelOne is a cybersecurity platform that provides endpoint protection by detecting and responding to threats in real-time. The rule identifies such threats by monitoring specific threat events, enabling analysts to swiftly investigate and mitigate potential security incidents. |
| 28 | +
|
| 29 | +### Possible investigation steps |
| 30 | +
|
| 31 | +- Correlate the threat alert with recent activity on the affected endpoint to identify any unusual or suspicious behavior patterns. |
| 32 | +- Check for any additional alerts or logs related to the same endpoint or user to determine if this is part of a broader attack or isolated incident. |
| 33 | +- Investigate the source and destination IP addresses involved in the threat to assess if they are known to be malicious or associated with previous threats. |
| 34 | +- Analyze any files or processes flagged in the threat alert to determine if they are legitimate or potentially malicious, using threat intelligence sources if necessary. |
| 35 | +- Consult the SentinelOne investigation guide and resources tagged in the alert for specific guidance on handling similar threats. |
| 36 | +
|
| 37 | +### False positive analysis |
| 38 | +
|
| 39 | +- Threats triggered by routine software updates or patches can be false positives. Review the context of the threat to determine if it aligns with scheduled maintenance activities. |
| 40 | +- Legitimate administrative tools or scripts may trigger threat alerts. Identify and whitelist these tools if they are verified as non-threatening. |
| 41 | +- Frequent threat alerts from known safe applications or processes can be excluded by creating exceptions for these specific behaviors in the SentinelOne configuration. |
| 42 | +- Network scanning or monitoring tools used by IT teams might be flagged. Ensure these tools are documented and excluded from triggering alerts if they are part of regular operations. |
| 43 | +- User behavior that is consistent with their role but triggers threat alerts should be reviewed. If deemed non-malicious, adjust the rule to exclude these specific user actions. |
| 44 | +
|
| 45 | +### Response and remediation |
| 46 | +
|
| 47 | +- Isolate the affected endpoint immediately to prevent lateral movement and further compromise within the network. |
| 48 | +- Analyze the specific threat alert details to identify the nature of the threat and any associated indicators of compromise (IOCs). |
| 49 | +- Remove or quarantine any malicious files or processes identified by the SentinelOne threat alert to neutralize the threat. |
| 50 | +- Apply relevant security patches or updates to address any exploited vulnerabilities on the affected endpoint. |
| 51 | +- Conduct a thorough scan of the network to identify any additional endpoints that may have been compromised or are exhibiting similar behavior. |
| 52 | +- Document the incident and escalate to the appropriate security team or management if the threat is part of a larger attack campaign or if additional resources are needed for remediation. |
| 53 | +- Review and update endpoint protection policies and configurations to enhance detection and prevention capabilities against similar threats in the future. |
| 54 | +""" |
| 55 | +references = ["https://docs.elastic.co/en/integrations/sentinel_one"] |
| 56 | +risk_score = 47 |
| 57 | +rule_id = "e43b7578-f3cc-4682-a8cf-f9d8a5fb07f1" |
| 58 | +rule_name_override = "message" |
| 59 | +setup = """## Setup |
| 60 | +
|
| 61 | +### SentinelOne Threat Integration |
| 62 | +This rule is designed to capture threat events generated by the SentinelOne integration and promote them as Elastic detection alerts. |
| 63 | +
|
| 64 | +To capture SentinelOne threat alerts, install and configure the SentinelOne integration to ingest threat events into the `logs-sentinel_one.threat-*` index pattern. |
| 65 | +
|
| 66 | +If this rule is enabled alongside the External Alerts promotion rule (UUID: eb079c62-4481-4d6e-9643-3ca499df7aaa), you may receive duplicate alerts for the same SentinelOne events. Consider adding a rule exception for the External Alert rule to exclude datastream.dataset: sentinel_one.threat to avoid receiving duplicate alerts. |
| 67 | +
|
| 68 | +### Additional notes |
| 69 | +
|
| 70 | +For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts). |
| 71 | +""" |
| 72 | +severity = "medium" |
| 73 | +tags = ["Data Source: SentinelOne", "Use Case: Threat Detection", "Resources: Investigation Guide", "Promotion: External Alerts"] |
| 74 | +timestamp_override = "event.ingested" |
| 75 | +type = "query" |
| 76 | + |
| 77 | +query = ''' |
| 78 | +event.kind: alert and data_stream.dataset: sentinel_one.threat |
| 79 | +''' |
| 80 | + |
| 81 | + |
| 82 | +[[rule.risk_score_mapping]] |
| 83 | +field = "event.risk_score" |
| 84 | +operator = "equals" |
| 85 | +value = "" |
| 86 | + |
| 87 | +[[rule.severity_mapping]] |
| 88 | +field = "sentinel_one.threat.confidence_level" |
| 89 | +operator = "equals" |
| 90 | +severity = "medium" |
| 91 | +value = "suspicious" |
| 92 | + |
| 93 | +[[rule.severity_mapping]] |
| 94 | +field = "sentinel_one.threat.confidence_level" |
| 95 | +operator = "equals" |
| 96 | +severity = "high" |
| 97 | +value = "malicious" |
0 commit comments