SentinelOne Integration

Overview

SentinelOne provides autonomous endpoint protection with AI-powered detection and response. KYRA MDR collects SentinelOne threat and activity data via the Singularity API or syslog forwarding for centralized security operations.

Prerequisites

• A KYRA MDR Collector installed and running
• SentinelOne Management Console access
• API token with Viewer or higher permissions
• Network connectivity from the console to the collector

Configuration

Configure SentinelOne syslog forwarding:

1. Log in to the SentinelOne Management Console
2. Navigate to Settings > Integrations > Syslog
3. Click Add Syslog Destination
4. Configure:

Setting	Value
Host	Your KYRA Collector IP
Port	514
Protocol	TCP
Format	CEF
Notifications	Threats, Activities

5. Click Test to verify connectivity
6. Click Save

SentinelOne API Integration

Use the SentinelOne Singularity API to query threats and activities:

# List recent threats
curl -s -X GET \
  "https://<CONSOLE>.sentinelone.net/web/api/v2.1/threats?limit=10&sortBy=createdAt&sortOrder=desc" \
  -H "Authorization: ApiToken <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" | jq '.data[] | {id, classification, agentComputerName, threatName, mitigationStatus}'

# Get threat details by ID
curl -s -X GET \
  "https://<CONSOLE>.sentinelone.net/web/api/v2.1/threats/<THREAT_ID>" \
  -H "Authorization: ApiToken <YOUR_API_TOKEN>" | jq .

# List recent activities (audit log)
curl -s -X GET \
  "https://<CONSOLE>.sentinelone.net/web/api/v2.1/activities?limit=20&sortBy=createdAt&sortOrder=desc" \
  -H "Authorization: ApiToken <YOUR_API_TOKEN>" | jq '.data[] | {activityType, primaryDescription, createdAt}'

# Get agent list
curl -s -X GET \
  "https://<CONSOLE>.sentinelone.net/web/api/v2.1/agents?limit=10" \
  -H "Authorization: ApiToken <YOUR_API_TOKEN>" | jq '.data[] | {computerName, osType, agentVersion, isActive, infected}'

Verify Syslog Reception

# On the KYRA Collector, verify incoming SentinelOne CEF events
sudo tcpdump -i any port 514 -A | grep -i "sentinelone\|S1"

# Check for CEF formatted events
tail -f /var/log/syslog | grep "CEF.*SentinelOne"

Collected Log Types

Log Type	Description	Security Use
Threats	Malware and behavioral threat detections	Endpoint threat response
Activities	Agent and management actions	Operational auditing
Deep Visibility	Endpoint telemetry data	Threat hunting, forensics
Application	Application inventory events	Shadow IT, vulnerability context
Device Control	USB and peripheral events	Data loss prevention
Ranger	Network discovery events	Asset discovery

Troubleshooting

No syslog events: Verify the syslog destination is enabled and tested in the SentinelOne console. Check that the notification types are selected.

CEF parsing issues: Ensure the format is set to CEF (Common Event Format). KYRA MDR includes a SentinelOne CEF parser.

API rate limiting: The SentinelOne API has rate limits. If using API-based collection, configure appropriate polling intervals (recommended: 60 seconds).

Contact kyra@seekerslab.com for support.