SentinelOne

Fluency's integration with SentinelOne has three portions:

As a SIEM, Fluency has the ability to accept Syslog export from SentinelOne's cloud portal.
Fluency can also use SentinelOne's API to collect and tabulate Agents, Applications and Threats information on the Fluency Resources page.
Lastly, Fluency can ingest and store SentinelOne's CloudFunnel 2.0 (an addtional S1 add-on) feed, to provide deep insight and complete visibility.

Syslog Export: Configuration

The Syslog configuration page is found under the Settings section of the SentinelOne main menu.

Under the Integrations tab, navigate to the Syslog Section.

Toggle Enable Syslog, and complete the Host section of the page.

Syslog Server

The log server address is the designated Syslog URL of your Fluency server.

<company>.syslog.fluencysecurity.com

The default normal Syslog port is UDP 514.

NOTE: This information can be found on the Setup Review page (under Overview section) in the Fluency Portal.

Syslog w/ TLS

It is also possible to configure Syslog over TCP with TLS. In this case, the Syslog port changes to TCP 6514.

A Server certificate is required.

NOTE: The CA cert file is also found and downloaded from the Setup Review page (under Overview section) in the Fluency Portal.

For all Syslog export methods, the CEF2 format should be selected.

Additionally, the Test button can be used to verify the connection.

Should the above test be successful, click Save to complete the Syslog configuration.

Note: the Syslog setting can be configured either 'per site' or 'per account' in the SentinelOne portal.
    Choose the appropriate scope for your deployment.

Syslog Notifications

The notification settings may need to be configured for Syslog. Navigate back to the the Settings section of the SentinelOne main menu, and choose the Notifications tab.

Note: Examine the Syslog column and select as many type as appropriate for your deployment.
    Fluency suggests selecting *ALL* event types, whenever possible.

API Integration

An API token from the SentinelOne portal is used by Fluency to provide API integration.

There are two methods to get an API token:

via an existing user, or
via a dedicated service account.

Existing User

To get an API token (attached to an existing user), select the User name, and choose My User in the upper right corner of the portal.

The dis-advantage of using an API token attached to an existing user is a shorter expiration time.

A user's API token will expire in 180 days

On this page, you can choose an option from the Actions dropdown to create or regenerate a new API token.

Copy the shown API Token on the next page, and save it for use in Fluency.

Dedicated Service Account

To create a dedicated service account, navigate to the Settings section of the SentinelOne main menu. Under the Users tab, navigate to the Service Users Section.

The Service User will allow API tokens to have a much longer Expiration Date.

On this page, you can choose an option from the Actions dropdown to create a new user.

Fill in the appropriate fields and choose Next to continue.

It is suggested to choose a longest expiration period allowable / possible.

On the following page, select the appropriate Scope (account/site) for your use case.

This API token will only require the Viewer permission, as the Fluency integration is read-only.

Copy the shown API Token on the next page, and save it for use in Fluency.

Adding a Fluency Plug-In for SentinelOne EDR

Open the Main Menu from the upper left-hand corner and choose the Integrations option under the Platform section.

On the Integrations page, go to the New Integrations tab and choose the SentinelOne integration, under Endpoint Management.

On the left-side panel, provide the required information and click "SAVE".

Cloud Funnel 2.0

If available, the Cloud Funnel configuration page is found under the Settings section of the SentinelOne main menu.

Under the Integrations tab, navigate to the Cloud Funnel Section.

Please contact Fluency Support to request a dedicated S3 bucket address for your S1 Cloud Funnel integration.

Use the following link to: Create a Support Ticket

It is also possible (but not suggested) to use your own, existing bucket for this integration. Please reach out to Fluency Support if you have this need.

Once you have recieved your S3 bucket address from Fluency support, click Validate to validate the connection, and then click Save.