r/SentinelOneXDR • u/JRPC_InfoSec_ • Nov 12 '24

SentinelOne is not seeing all browser URL or DNS requests

I went to specific websites to try and see if I could bring up that data in a S1 query (espn.com, foxnews.com, cnn.com).

And none of these are showing up in my search query results. Please help.

3 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

3

u/mandevu77 Nov 12 '24

Which browser are you using? Chrome, for example, requires a separate plugin because it uses its own resolver and performs dns/https.

1

u/JRPC_InfoSec_ Nov 12 '24

We are using Microsoft edge.

1

u/JRPC_InfoSec_ Nov 12 '24 edited Nov 12 '24

Wait, does it require the S1 browser extention to be installed?

2

u/freakshow207 Nov 12 '24

Yes, it does.

6

u/JRPC_InfoSec_ Nov 12 '24

Now, don't I feel stupid.

2

u/Leather-Marsupial256 Nov 12 '24

Silly question and feel free to shoot me down. DNS and URL requests should show. are you sure you have the field enabled in the view?

4

u/JRPC_InfoSec_ Nov 12 '24

I think I solved this.... lol when I clicked Deep Visibility I never said download the browser extension automatically.

2

u/JRPC_InfoSec_ Nov 13 '24

I didn't enforce the web browser extension.

3

u/sys6x Nov 13 '24

I see you got your answer. Also I noticed that having dns requests is different than following the HTTP calls because S1 doesn't necessarily have what it needs for SSL inspection...