Collect SentinelOne Deep Visibility logs

This document explains how to export SentinelOne Deep Visibility logs to Google Security Operations using Cloud Funnel for exporting logs to Google Cloud Storage. The parser transforms raw JSON formatted security event logs into a structured format conforming to the UDM. It first initializes a set of variables, then extracts the event type and parses the JSON payload, mapping relevant fields to the UDM schema while handling Windows event logs separately.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• Privileged access to Google Cloud
• SentinelOne Deep Visibility set up in your environment
• Privileged access to SentinelOne

Create a Google Cloud Storage Bucket

1. Sign in to the Google Cloud console.

2. Go to the Cloud Storage Buckets page.

   Go to Buckets

3. Click Create.

4. On the Create a bucket page, enter your bucket information. After each of the following steps, click Continue to proceed to the next step:

   1. In the Get started section, do the following:

      1. Enter a unique name that meets the bucket name requirements; for example, sentinelone-deepvisibility.

      2. To enable hierarchical namespace, click the expander arrow to expand the Optimize for file oriented and data-intensive workloads section, and then select Enable Hierarchical namespace on this bucket.

      3. To add a bucket label, click the expander arrow to expand the Labels section.

      4. Click Add label, and specify a key and a value for your label.

   2. In the Choose where to store your data section, do the following:

      1. Select a Location type.

      2. Use the ___location type menu to select a Location where object data within your bucket will be permanently stored.

      3. To set up cross-bucket replication, expand the Set up cross-bucket replication section.

   3. In the Choose a storage class for your data section, either select a default storage class for the bucket, or select Autoclass for automatic storage class management of your bucket's data.

   4. In the Choose how to control access to objects section, select not to enforce public access prevention, and select an access control model for your bucket's objects.

   5. In the Choose how to protect object data section, do the following:

      1. Select any of the options under Data protection that you want to set for your bucket.
      2. To choose how your object data will be encrypted, click the expander arrow labeled Data encryption, and select a Data encryption method.

5. Click Create.

Create a Google Cloud Service Account

1. Go to IAM & Admin > Service Accounts.
2. Create a new service account.
3. Give it a descriptive name; for example, sentinelone-dv-logs.
4. Grant the service account with Storage Object Creator role on the Cloud Storage bucket you created in the previous step.
5. Create an SSH key for the service account.
6. Download a JSON key file for the service account. Keep this file secure.

How to configure Cloud Funnel in SentinelOne DeepVisibility

1. Sign in to the SentinelOne DeepVisibility.
2. Click Configure > Policy & Settings.
3. In the Singularity Data Lake section, click Cloud Funnel.
4. Provide the following configuration details:
   • Cloud Provider: Select Google Cloud.
   • Bucket Name: Enter the name of the Cloud Storage bucket that you created for SentinelOne DeepVisibility log ingestion.
   • Telemetry Streaming: Select Enable.
   • Query Filters: Create a query that includes the agents that need to send data to a Cloud Storage bucket.
   • Click Validate.
   • Fields to include: Select all fields.
5. Click Save.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New
• Content Hub > Content Packs > Get Started

How to set up the SentinelOne Deep Visibility feed

1. Click the SentinelOne pack.
2. In the SentinelOne Deep Visibility log type, specify the values for the following fields:
   • Source type: Google Cloud Storage V2.
   • Storage bucket URI: The Google Cloud Storage bucket source URI.
   • Source deletion option: Whether to delete files or directories after transferring. Select the Delete transferred files option in Source deletion option.
   • Maximum File Age: Include files modified within the last number of days. Default is 180 days.
   • Chronicle Service Account: Copy the Service Account. You'll need it to add permissions in the bucket for this Service Account to let Google SecOps read or delete data in the bucket.

Advanced options

• Feed Name: A prepopulated value that identifies the feed.
• Asset Namespace: Namespace associated with the feed.
• Ingestion Labels: Labels applied to all events from this feed.
• Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.