Analyzer support for CrowdStrike and SentinelOne

[natasha-moore-elastic]

Contributes to #2024. Updates the visual event analyzer docs to document support for analyzing events from CrowdStrike and SentinelOne integrations.

Preview: Visual event analyzer

8.x PR: elastic/security-docs#6989

[github-actions]

🔍 Preview links for changed docs

• solutions/security/investigate/visual-event-analyzer.md

[florent-leborgne]

LGTM

[nastasha-solomon]

lgtm!

[raqueltabuyo]

@natasha-moore-elastic I think we need to specify a little bit more on the Crowdstrike side, not sure if all the integration types are supported. I think only Crowdstrike Event Stream and Falcon Data Replicator. @tomsonpl can you confirm this? what is your opinion on this one?

[raqueltabuyo]

Specify the Crowdstrike mode of integration that supports analyzer. I think it is only supported with Crowdstrike Event Stream and Falcon Data Replicar but better confirm with @tomsonpl

[tomsonpl]

Hey @raqueltabuyo @natasha-moore-elastic 👋

Although it's still the same integration, I think we might mention that analyzer needs process data that comes from either FDR or Falcon Logs.

Screenshot for reference.

[natasha-moore-elastic]

Thanks @tomsonpl! I've added this info now, but let me know if we need to describe this in more detail.
cc @raqueltabuyo

[raqueltabuyo]

Thanks @tomsonpl! I've added this info now, but let me know if we need to describe this in more detail. cc @raqueltabuyo

Hey @natasha-moore-elastic SIEM Connector won't help much here, after speaking with @tomsonpl , we think instead we can have the following:

You can visualize events from the following sources:

- Elastic Defend integration
- Sysmon data collected through Winlogbeat
- CrowdStrike integration (Falcon logs collected through Event Stream or FDR)
- SentinelOne Cloud Funnel integration

[natasha-moore-elastic]

Thanks @tomsonpl! I've added this info now, but let me know if we need to describe this in more detail. cc @raqueltabuyo

Hey @natasha-moore-elastic SIEM Connector won't help much here, after speaking with @tomsonpl , we think instead we can have the following:

You can visualize events from the following sources:

- Elastic Defend integration
- Sysmon data collected through Winlogbeat
- CrowdStrike integration (Falcon logs collected through Event Stream or FDR)
- SentinelOne Cloud Funnel integration

Thanks @raqueltabuyo, I've updated to your suggested wording 👍