Collect SentinelOne Deep Visibility logs

This document explains how to export SentinelOne Deep Visibility logs to Google Security Operations using Cloud Funnel for exporting logs to Google Cloud Storage. The parser transforms raw JSON formatted security event logs into a structured format conforming to the UDM. It first initializes a set of variables, then extracts the event type and parses the JSON payload, mapping relevant fields to the UDM schema while handling Windows event logs separately.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• Privileged access to Google Cloud
• SentinelOne Deep Visibility set up in your environment
• Privileged access to SentinelOne

Create a Google Cloud Storage Bucket

1. Sign in to the Google Cloud console.

2. Go to the Cloud Storage Buckets page.

   Go to Buckets

3. Click Create.

4. On the Create a bucket page, enter your bucket information. After each of the following steps, click Continue to proceed to the next step:

   1. In the Get started section, do the following:

      1. Enter a unique name that meets the bucket name requirements; for example, sentinelone-deepvisibility.

      2. To enable hierarchical namespace, click the expander arrow to expand the Optimize for file oriented and data-intensive workloads section, and then select Enable Hierarchical namespace on this bucket.

      3. To add a bucket label, click the expander arrow to expand the Labels section.

      4. Click Add label, and specify a key and a value for your label.

   2. In the Choose where to store your data section, do the following:

      1. Select a Location type.

      2. Use the location type menu to select a Location where object data within your bucket will be permanently stored.

      3. To set up cross-bucket replication, expand the Set up cross-bucket replication section.

   3. In the Choose a storage class for your data section, either select a default storage class for the bucket, or select Autoclass for automatic storage class management of your bucket's data.

   4. In the Choose how to control access to objects section, select not to enforce public access prevention, and select an access control model for your bucket's objects.

   5. In the Choose how to protect object data section, do the following:

      1. Select any of the options under Data protection that you want to set for your bucket.
      2. To choose how your object data will be encrypted, click the expander arrow labeled Data encryption, and select a Data encryption method.

5. Click Create.

Create a Google Cloud Service Account

1. Go to IAM & Admin > Service Accounts.
2. Create a new service account.
3. Give it a descriptive name; for example, sentinelone-dv-logs.
4. Grant the service account with Storage Object Creator role on the Cloud Storage bucket you created in the previous step.
5. Create an SSH key for the service account.
6. Download a JSON key file for the service account. Keep this file secure.

How to configure Cloud Funnel in SentinelOne DeepVisibility

1. Sign in to the SentinelOne DeepVisibility.
2. Click Configure > Policy & Settings.
3. In the Singularity Data Lake section, click Cloud Funnel.
4. Provide the following configuration details:
   • Cloud Provider: Select Google Cloud.
   • Bucket Name: Enter the name of the Cloud Storage bucket that you created for SentinelOne DeepVisibility log ingestion.
   • Telemetry Streaming: Select Enable.
   • Query Filters: Create a query that includes the agents that need to send data to a Cloud Storage bucket.
   • Click Validate.
   • Fields to include: Select all fields.
5. Click Save.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds
• Content Hub > Content Packs

Set up feeds from SIEM Settings > Feeds

To configure multiple feeds for different log types within this product family, see Configure feeds by product.

To configure a single feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed; for example, SentinelOne DV Logs.
5. Select Google Cloud Storage as the Source type.
6. Select SentinelOne Deep Visibility as the Log type.
7. Click Get Service Account as the Chronicle Service Account.
8. Click Next.

9. Specify values for the following input parameters:

   • Storage Bucket URI: Google Cloud Storage bucket URL in gs://my-bucket/<value> format.
   • URI Is A: Select Directory which includes subdirectories.

   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Asset namespace: The asset namespace.

   • Ingestion labels: The label applied to the events from this feed.

10. Click Next.

11. Review your new feed configuration in the Finalize screen, and then click Submit.

Set up feeds from the Content Hub

Specify values for the following fields:

• Storage bucket URI: The Google Cloud Storage bucket source URI.
• URI is a: Select the URI TYPE according to log stream configuration (Single file | Directory | Directory which includes subdirectories).
• Source deletion options: Select the deletion option according to your ingestion preferences.

Advanced options

• Feed Name: A prepopulated value that identifies the feed.
• Source Type: Method used to collect logs into Google SecOps.
• Asset Namespace: Namespace associated with the feed.
• Ingestion Labels: Labels applied to all events from this feed.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.