Add SentinelOne Data Lake integration guide (#423)

Signed-off-by: bcmmbaga <[email protected]>

Author: bcmmbaga

public/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/api-key-generation.png

@@ -192,6 +192,7 @@ export const docsNavigation = [
                          { title: 'Datadog', href: '/how-to/stream-activity-to-datadog' },
                          { title: 'Amazon S3', href: '/how-to/stream-activity-to-amazon-s3' },
                          { title: 'Amazon Firehose', href: '/how-to/stream-activity-to-amazon-firehose'},
+                         { title: 'SentinelOne Data Lake', href: '/how-to/stream-activity-to-sentinelone-data-lake'},
                          { title: 'Generic HTTP', href: '/how-to/stream-activity-to-generic-http'},
                      ]
                  },

public/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/custom-template.png

@@ -21,4 +21,5 @@ supported third-party platforms. To get started, select one of the following int
 - [Datadog](/how-to/stream-activity-to-datadog)
 - [Amazon S3](/how-to/stream-activity-to-amazon-s3)
 - [Amazon Data Firehose](/how-to/stream-activity-to-amazon-firehose)
+- [SentinelOne Data Lake](/how-to/stream-activity-to-sentinelone-data-lake)
 - [Generic HTTP](/how-to/stream-activity-to-generic-http)

public/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/general-settings.png

@@ -0,0 +1,77 @@
+# Stream Network Activity to SentinelOne Singularity Data Lake
+
+[SentinelOne Singularity Data Lake](https://www.sentinelone.com/platform/data-lake/)  provides a centralized repository for storing and analyzing security data across your organization. By streaming NetBird network activity events to SentinelOne Data Lake, you can correlate network connectivity events with endpoint security data for comprehensive threat detection and investigation.
+
+This integration leverages NetBird's Generic HTTP streaming capability with SentinelOne Singularity Data Lake-specific configurations to ensure seamless data ingestion into your Data Lake environment.
+
+<Note>
+    This feature is only available in the cloud version of NetBird.
+</Note>
+
+## Prerequisites
+
+Before you start creating and configuring a SentinelOne Singularity Data Lake event streaming integration, ensure that you have the following:
+- A SentinelOne account with Singularity Data Lake access and appropriate permissions
+- Administrative access to create API keys in your SentinelOne console
+
+## Create a SentinelOne API Token
+
+- Log in to your SentinelOne Management Console and navigate to **Visibility** from the left menu
+- Click on your user email dropdown in the top right toolbar and select **API Keys**
+- Under the **Log Access Keys** section, click **Add Key** dropdown menu and select **Add Write Key**
+- A new API key will be created with access to write logs to Data Lake
+- Click **Copy to Clipboard** and store this token securely. You will need this token when configuring the integration in NetBird.
+
+<p>
+    <img src="/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/api-key-generation.png" alt="API Key Generation" className="imagewrapper-big"/>
+</p>
+
+## Get the HEC Ingestion URL
+
+Navigate to `https://<your-tenant>.sentinelone.net/docs/en/http-event-collector--hec-.html#http-event-collector--hec-` (replace `<your-tenant>` with your actual SentinelOne tenant)
+to find and copy the HTTP Event Collector base URL from the documentation page. The URL format will be `https://ingest.<region>.sentinelone.net` where `<region>` is your deployment region.
+
+## Create an Integration in NetBird
+
+- Navigate to the **Integrations** tab in the NetBird dashboard and select **Event Streaming**
+- Find the **Generic HTTP** option and click **Connect Generic HTTP**
+- Configure the endpoint URL by entering the full HEC endpoint URL: `https://ingest.<region>.sentinelone.net/services/collector/event`
+- Select **Bearer Token** for authentication and provide the API token you created earlier
+
+<p>
+    <img src="/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/general-settings.png" alt="General Settings Configuration" className="imagewrapper-big"/>
+</p>
+
+- Enable the custom body template and use the following template optimized for SentinelOne Singularity Data Lake:
+
+```json
+{
+  "id": "{{.ID}}",
+  "time": "{{.Timestamp.UnixNano}}",
+  "event": "{{.Message}}",
+  "initiator_id": "{{.InitiatorID}}",
+  "target_id": "{{.TargetID}}",
+  "host": "netbird",
+  "source": "netbird",
+  "sourcetype": "json",
+  "fields": "{{.Meta}}"
+}
+```
+
+<p>
+    <img src="/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/custom-template.png" alt="Custom Template Configuration" className="imagewrapper-big"/>
+</p>
+
+## Verify the Integration
+
+After configuring the SentinelOne Singularity Data Lake integration in NetBird, you can verify that the integration is working correctly by checking the SentinelOne Singularity Data Lake for incoming events. If the integration is successful, you should see test events from NetBird in your Data Lake.
+
+- Navigate to **Data Lake** > **Search** > **New Search** in your SentinelOne console
+- Select to search **All Data** and filter for recent events with source **netbird**
+- Verify the test events appear with the expected structure
+
+<p>
+    <img src="/docs-static/img/how-to-guides/activity-event-streaming/sentinelone-data-lake/verify-integration.png" alt="Verify Integration" className="imagewrapper-big"/>
+</p>
+
+The integration is now set up and ready to stream network activity events to SentinelOne Singularity Data Lake.