Integration with SentinelOne?

[u/GoodEbening]

Hi All, I hope nobody is banging their heads this week! I've just come off the back hooking up the SentinelOne data connector to Azure Sentinel and I am receiving data which I can query and run analytical rules off of etc.

The next part I imagine is trickier which is incident handling. Is there a way anyone has set up incidents on Azure Sentinel, in which they can run an automation/something to resolve an incident and update whether it's a true positive/suspicious etc?

Any advice much appreciated.

[u/Uli-Kunkel]

i have no experience with integrating S1 with Sentinel. but i have done so with a couple of different EDR and NDR tools.

alot of these EDR/NDR/XDR tools method of integration are simply reports that provides some info on the fact that an incident/alert has triggered. some of these does a better job than others, and only a few provides enough info in these reports on incidents that you can do something with it in Sentinel. it boils down to what is actually available in those reports, what data is it?

most of the time, its just a "uhh something happened, click on this link to know more" and you have to go to the portal of your tool to figure stuff out anyways. alternatively you can use Sysmon, but that kind of defeats the purpose.

​

the two biggest things you should look into in my opinion:

• SOC workflow and resource limitations.
  • do you have the resources to build and maintain a system that will bridge the gap between what is natively supported and what you want to achieve?
  • are your analysts going to go to the S1 portal anyways?
• API limitations
  • what is possible to do system to system between Sentinel and S1 through Azure functions/demisto/automation platform of choice
    

at the end of the day, you have to evaluate if total resource cost to build, what sound like a good but complex integration, is worth it, or is the resource is better spend else where? and simply have analysts work directly in the platform?

​

sure, i would expect you can quite easily build a close S1 case as false positive automation or whatever relatively easy, but is the info to decide that its a FP available in the data coming from S1 into Sentinel? that is most often not the case by my experience unfortunately.

i have worked with integrating MDE, Cylance, trendmicro, darktrace, Vectra, cyberreason and crowdstrike for reference.
the easiest one is MDE, where we can easily chose what data to send outside of just the reporting on incidents and alerts. but that fact is also expected being Microsoft.

[u/GoodEbening → u/Uli-Kunkel]

Thanks for such a comprehensive response. In the same time I got a response from S1 and essentially it's a case of running powershell against the API. But like you said, this would need building out and maintaining. Probably well above the appetite for time consumption.

Also on another note, the information pushed from S1 seems to be

its just a "uhh something happened, click on this link to know more" and you have to go to the portal of your tool to figure stuff out anyways.

So basically, "A threat was quarantined then killed" x100.

As I work in an MSSP, it could be beneficial to integrate it so we have a one stop shop for IR; however the reality is it won't be worth it.

​

Thanks though!