Skip to content

Commit 60ac006

Browse files
mohitjha-elasticmohitjha-elastic
authored
sentinel_one: Add support for application risk data stream and ilm policy to application data stream.
Added support for ingesting data through the SentinelOne application risk data stream. This includes necessary configuration updates and input adjustments to enable collection and parsing of application risk–related events, ensuring accurate ingestion and processing of risk insights from supported sources. Also added ilm policy to the application data stream. Tested on the live samples collected through the SentinelOne API.
1 parent 49f1fae commit 60ac006

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+3523
-18
lines changed

‎packages/sentinel_one/_dev/benchmark/rally/application_risk-benchmark.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
description: Benchmark 100000 sentinel_one.application_risk events ingested
3+
data_stream:
4+
name: application_risk
5+
corpora:
6+
generator:
7+
total_events: 100000
8+
template:
9+
type: gotext
10+
path: ./applicationrisk-benchmark/template.ndjson
11+
config:
12+
path: ./applicationrisk-benchmark/config.yml
13+
fields:
14+
path: ./applicationrisk-benchmark/fields.yml

‎packages/sentinel_one/_dev/benchmark/rally/applicationrisk-benchmark/config.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
fields:
2+
- name: application
3+
cardinality: 1000
4+
- name: applicationName
5+
cardinality: 10000
6+
- name: applicationVendor
7+
cardinality: 10
8+
- name: applicationVersion
9+
cardinality: 10
10+
- name: baseScore
11+
range:
12+
min: 1
13+
max: 10
14+
fuzziness: 0.01
15+
- name: cveId
16+
cardinality: 1000
17+
- name: cvssVersion
18+
cardinality: 100
19+
- name: daysDetected
20+
range:
21+
min: 0
22+
max: 10000
23+
cardinality: 1000
24+
- name: endpointId
25+
range:
26+
min: 100000000000000000
27+
max: 999999999999999999
28+
cardinality: 10000
29+
enum:
30+
- desktop
31+
- laptop
32+
- server
33+
- unknown
34+
- name: endpointName
35+
cardinality: 1000
36+
- name: endpointType
37+
- name: exploitCodeMaturity
38+
cardinality: 1000
39+
- name: id
40+
range:
41+
min: 100000000000000000
42+
max: 999999999999999999
43+
cardinality: 10000
44+
- name: lastScanResult
45+
cardinality: 10
46+
- name: markType
47+
cardinality: 1000
48+
- name: markedBy
49+
cardinality: 1000
50+
- name: mitigationStatus
51+
cardinality: 1000
52+
- name: mitigationStatusChangeTime
53+
cardinality: 1000
54+
- name: mitigationStatusChangedBy
55+
cardinality: 1000
56+
- name: mitigationStatusReason
57+
cardinality: 1000
58+
- name: nvdBaseScore
59+
range:
60+
min: 1
61+
max: 10
62+
fuzziness: 0.01
63+
- name: nvdCvssVersion
64+
cardinality: 1000
65+
- name: osType
66+
enum:
67+
- linux
68+
- windows
69+
- macos
70+
- windows_legacy
71+
- name: reason
72+
cardinality: 1000
73+
- name: remediationLevel
74+
cardinality: 1000
75+
- name: reportConfidence
76+
cardinality: 1000
77+
- name: riskScore
78+
range:
79+
min: 1
80+
max: 10
81+
fuzziness: 0.01
82+
- name: severity
83+
enum:
84+
- HIGH
85+
- MEDIUM
86+
- LOW
87+
- name: status
88+
cardinality: 10

‎packages/sentinel_one/_dev/benchmark/rally/applicationrisk-benchmark/fields.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
- name: application
2+
type: keyword
3+
- name: applicationName
4+
type: keyword
5+
- name: applicationVendor
6+
type: keyword
7+
- name: applicationVersion
8+
type: keyword
9+
- name: baseScore
10+
type: float
11+
- name: cveId
12+
type: keyword
13+
- name: cvssVersion
14+
type: keyword
15+
- name: daysDetected
16+
type: long
17+
- name: endpointId
18+
type: keyword
19+
- name: endpointName
20+
type: keyword
21+
- name: endpointType
22+
type: keyword
23+
- name: exploitCodeMaturity
24+
type: keyword
25+
- name: id
26+
type: keyword
27+
- name: lastScanResult
28+
type: keyword
29+
- name: markType
30+
type: keyword
31+
- name: markedBy
32+
type: keyword
33+
- name: mitigationStatus
34+
type: keyword
35+
- name: mitigationStatusChangeTime
36+
type: date
37+
- name: mitigationStatusChangedBy
38+
type: keyword
39+
- name: mitigationStatusReason
40+
type: keyword
41+
- name: nvdBaseScore
42+
type: double
43+
- name: nvdCvssVersion
44+
type: keyword
45+
- name: osType
46+
type: keyword
47+
- name: reason
48+
type: keyword
49+
- name: remediationLevel
50+
type: keyword
51+
- name: reportConfidence
52+
type: keyword
53+
- name: riskScore
54+
type: double
55+
- name: severity
56+
type: keyword
57+
- name: status
58+
type: keyword

‎packages/sentinel_one/_dev/benchmark/rally/applicationrisk-benchmark/template.ndjson‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{{- $application := generate "application" }}
2+
{{- $applicationName := generate "applicationName" }}
3+
{{- $applicationVendor := generate "applicationVendor" }}
4+
{{- $applicationVersion := generate "applicationVersion" }}
5+
{{- $baseScore := generate "baseScore" }}
6+
{{- $cveId := generate "cveId" }}
7+
{{- $cvssVersion := generate "cvssVersion" }}
8+
{{- $daysDetected := generate "daysDetected" }}
9+
{{- $endpointId := generate "endpointId" }}
10+
{{- $endpointName := generate "endpointName" }}
11+
{{- $endpointType := generate "endpointType" }}
12+
{{- $exploitCodeMaturity := generate "exploitCodeMaturity" }}
13+
{{- $id := generate "id" }}
14+
{{- $lastScanResult := generate "lastScanResult" }}
15+
{{- $markType := generate "markType" }}
16+
{{- $markedBy := generate "markedBy" }}
17+
{{- $mitigationStatus := generate "mitigationStatus" }}
18+
{{- $mitigationStatusChangedBy := generate "mitigationStatusChangedBy" }}
19+
{{- $mitigationStatusReason := generate "mitigationStatusReason" }}
20+
{{- $nvdBaseScore := generate "nvdBaseScore" }}
21+
{{- $nvdCvssVersion := generate "nvdCvssVersion" }}
22+
{{- $osType := generate "osType" }}
23+
{{- $reason := generate "reason" }}
24+
{{- $remediationLevel := generate "remediationLevel" }}
25+
{{- $reportConfidence := generate "reportConfidence" }}
26+
{{- $riskScore := generate "riskScore" }}
27+
{{- $severity := generate "severity" }}
28+
{{- $status := generate "status" }}
29+
{{- /*
30+
{
31+
"application": "{{ $application }}",
32+
"applicationName": "{{ $applicationName }}",
33+
"applicationVendor": "{{ $applicationVendor }}",
34+
"applicationVersion": "{{ $applicationVersion }}",
35+
"baseScore": "{{ $baseScore }}",
36+
"cveId": "{{ $cveId }}",
37+
"cvssVersion": "{{ $cvssVersion }}",
38+
"daysDetected": "{{ $daysDetected }}",
39+
"endpointId": "{{ $endpointId }}",
40+
"endpointName": "{{ $endpointName }}",
41+
"endpointType": "{{ $endpointType }}",
42+
"exploitCodeMaturity": "{{ $exploitCodeMaturity }}",
43+
"id": "{{ $id }}",
44+
"lastScanResult": "{{ $lastScanResult }}",
45+
"markType": "{{ $markType }}",
46+
"markedBy": "{{ $markedBy }}",
47+
"mitigationStatus": "{{ $mitigationStatus }}",
48+
"mitigationStatusChangedBy": "{{ $mitigationStatusChangedBy }}",
49+
"mitigationStatusReason": "{{ $mitigationStatusReason }}",
50+
"nvdBaseScore": "{{ $nvdBaseScore }}",
51+
"nvdCvssVersion": "{{ $nvdCvssVersion }}",
52+
"osType": "{{ $osType }}",
53+
"reason": "{{ $reason }}",
54+
"remediationLevel": "{{ $remediationLevel }}",
55+
"reportConfidence": "{{ $reportConfidence }}",
56+
"riskScore": "{{ $riskScore }}",
57+
"severity": "{{ $severity }}",
58+
"status": "{{ $status }}"
59+
}
60+
*/ -}}
61+
{
62+
"agent": {
63+
"ephemeral_id": "cdaaaabb-be7e-432f-816b-bda019fd7c15",
64+
"id": "da6cb4c8-c84c-4c5f-97c7-f8586a098af4",
65+
"name": "docker-fleet-agent",
66+
"type": "filebeat",
67+
"version": "8.18.0"
68+
},
69+
"data_stream": {
70+
"dataset": "sentinel_one.application_risk",
71+
"namespace": "93724",
72+
"type": "logs"
73+
},
74+
"elastic_agent": {
75+
"id": "da6cb4c8-c84c-4c5f-97c7-f8586a098af4",
76+
"snapshot": false,
77+
"version": "8.18.0"
78+
},
79+
"message": "{\"application\": \"{{ $application }}\", \"applicationName\": \"{{ $applicationName }}\", \"applicationVendor\": \"{{ $applicationVendor }}\", \"applicationVersion\": \"{{ $applicationVersion }}\", \"baseScore\": \"{{ $baseScore }}\", \"cveId\": \"{{ $cveId }}\", \"cvssVersion\": \"{{ $cvssVersion }}\", \"daysDetected\": \"{{ $daysDetected }}\", \"endpointId\": \"{{ $endpointId }}\", \"endpointName\": \"{{ $endpointName }}\", \"endpointType\": \"{{ $endpointType }}\", \"exploitCodeMaturity\": \"{{ $exploitCodeMaturity }}\", \"id\": \"{{ $id }}\", \"lastScanResult\": \"{{ $lastScanResult }}\", \"markType\": \"{{ $markType }}\", \"markedBy\": \"{{ $markedBy }}\", \"mitigationStatus\": \"{{ $mitigationStatus }}\", \"mitigationStatusChangedBy\": \"{{ $mitigationStatusChangedBy }}\", \"mitigationStatusReason\": \"{{ $mitigationStatusReason }}\", \"nvdBaseScore\": \"{{ $nvdBaseScore }}\", \"nvdCvssVersion\": \"{{ $nvdCvssVersion }}\", \"osType\": \"{{ $osType }}\", \"reason\": \"{{ $reason }}\", \"remediationLevel\": \"{{ $remediationLevel }}\", \"reportConfidence\": \"{{ $reportConfidence }}\", \"riskScore\": \"{{ $riskScore }}\", \"severity\": \"{{ $severity }}\", \"status\": \"{{ $status }}\"}",
80+
"event": {
81+
"dataset": "sentinel_one.application_risk"
82+
},
83+
"input": {
84+
"type": "cel"
85+
},
86+
"tags": [
87+
"preserve_original_event",
88+
"forwarded",
89+
"sentinel_one-application_risk"
90+
]
91+
}

‎packages/sentinel_one/_dev/build/docs/README.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,14 @@ This is the `application` dataset.
7373

7474
{{fields "application"}}
7575

76+
### application risk
77+
78+
This is the `application risk` dataset.
79+
80+
{{event "application_risk"}}
81+
82+
{{fields "application_risk"}}
83+
7684
### group
7785

7886
This is the `group` dataset.
@@ -87,4 +95,4 @@ This is the `threat` dataset.
8795

8896
{{event "threat"}}
8997

90-
{{fields "threat"}}
98+
{{fields "threat"}}

0 commit comments

Comments
 (0)