IBM Security QRadar

 View Only

  • 1.  SentinelOne Connector App Integration

    Posted Fri March 15, 2024 07:18 AM
      |   view attached

    Hi,

    To configure the sentinelone EDR via sentinelone connector app, I tried to add the log source as per the document.  But there is no protocol type in the QRadar for the log source type SentinelOne API.

    Any option to complete the integration?

    Thanks



    ------------------------------
    Arunkumar R
    ------------------------------

    Attachment(s)

    pdf
    SentinelOne_ConnectorV2.0.0(Updated).pdf   1.84 MB 1 version


  • 2.  RE: SentinelOne Connector App Integration

    Posted Tue March 19, 2024 09:43 AM

    Does this help it shows that the connector type is API:
    https://www.ibm.com/docs/en/uax?topic=activeedr-sentinelone-data-source-type-specifications



    ------------------------------
    JOHN HANDROP
    ------------------------------

    Original Message


  • 3.  RE: SentinelOne Connector App Integration

    Posted Wed March 20, 2024 05:00 AM

    Hi Arunkumar,

    integrating Sentinel can be a little confusing as there exist three ways. The one you attached relays on a new protocol type that should be installed when you install the extension mentioned in your document. Maybe it will be available after the deploy. If this is not the case you could also download it from ibm fix central install it manually (see https://www.ibm.com/support/pages/qradar-using-yum-manually-install-reinstall-or-search-rpm-packages). What John mentioned is another way of integrating it without an additional Logsource type using the universal one. 

    Have great day!

    Martin



    ------------------------------
    Martin Schmitt
    Senior Cyber Defense Consultant
    SECUINFRA
    Berlin
    ------------------------------

    Original Message