sentinel_one_cloud_funnel: improve detection rules support #9120

efd6 · 2024-02-12T06:48:33Z

Proposed commit message

See title.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

The original private issue asks for process.executable.caseless and process.name.caseless. These are not ECS fields, so are not added. They are multi-fields defined in some contexts.
Documentation for sentinel one fields is largely absent. I used https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-sentinelone-cf and https://docs.cyderes.cloud/parser-knowledge-base/sentinel_dv/#parser-details which give some details which in conjunction with the events that we have enable field values to be extrapolated.

How to test this PR locally

First

$ export AWS_DEFAULT_PROFILE=elastic-siem
$ aws-mfa --profile=elastic-siem
$ eval $(grep ^aws ~/.aws/credentials | gsed -r 's/^(aws[^ ]+) = (.*)$/export \U\1\E=\2/g')

(gsed is GNU sed so if on macos you will need to install that, if on linux s/gsed/sed/ in the command above)

then test with elastic-package as normal.

Related issues

Closes [SentinelOne Cloud Funnel] Adjust mappings for detection rules #9086

Screenshots

elasticmachine · 2024-02-12T20:41:06Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2024-02-15T01:24:30Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

w0rk3r

Awesome work 🧙🏼 🔥 🧙🏼 🔥 🧙🏼 🔥 🧙🏼 🔥

w0rk3r · 2024-02-15T14:31:19Z

packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml

+      field: process.code_signature.trusted
+      value: false
+      override: false
+      if: ctx.process?.code_signature?.exists == true


I am not sure if I understood this one, this will set process.code_signature.trusted to false whenever the signature exists? Or only if the ctx.sentinel_one_cloud_funnel?.event?.src?.process?.verified_status?.contains('verified') == true returns false?

So the previous set sets the process.code_signature.trusted value to true if sentinel_one_cloud_funnel.event.src.process.verified_status contains "verified". This one sets it to false if a signature exists but process.code_signature.trusted is not already set (override: false). So if the previous set has not fired, and we have a signature then we have not verified it, so set to false.

w0rk3r · 2024-02-15T14:32:01Z

...tinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-registry.yml

      copy_from: sentinel_one_cloud_funnel.event.registry.key.path
      ignore_empty_value: true
+      description: Implements Windows-like SplitCommandLine


Should we change this description?

Yep, that is copy/paste error.

tomsonpl

Hey, thanks for the good work! I left one question :)

tomsonpl · 2024-02-19T07:40:25Z

...ntinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml

@@ -6,7 +6,16 @@ processors:
      value: [process]
  - set:
      field: event.type
-      value: [info]
+      value: [start]


tomsonpl · 2024-02-19T07:48:09Z

packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml

@@ -229,6 +240,10 @@ processors:
      field: json.src.process.image.path
      target_field: sentinel_one_cloud_funnel.event.src.process.image.path
      ignore_missing: true
+  - set:


I am wondering if this should be set from tgt instead of src in pipeline-process.yml, where I think we overwrite the 'hierarchy'

- set: field: process.executable copy_from: sentinel_one_cloud_funnel.event.tgt.process.image.path ignore_empty_value: true

The choice of src here was purely because of the local context; I have no expertise in the semantics of sentinel one fields, so if we have some expertise in this, that would be helpful.

kcreddy

Few minor suggestions. LGTM 👍🏼

kcreddy · 2024-02-21T07:28:21Z

...es/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-url.log-expected.json

@@ -2,6 +2,9 @@
    "expected": [
        {
            "@timestamp": "2022-10-03T15:32:29.475Z",
+            "destination": {
+                "address": "www.asdf.com"


Should we also capture into destination.domain?

WDYT @tomsonpl @w0rk3r?

Sounds good to me

No opinion, sorry!

packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml

elasticmachine · 2024-03-05T20:38:23Z

💚 Build Succeeded

Buildkite Build
Commit: 1e79d02

History

💚 Build #9235 succeeded 47ac63c
💚 Build #9043 succeeded c0c0b81
💚 Build #8975 succeeded 1e0b467
💚 Build #8888 succeeded 5fe3280
💚 Build #8887 succeeded e67c39f
💚 Build #8883 succeeded 4d9ffde

cc @efd6

elastic-sonarqube · 2024-03-05T20:38:24Z

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
86.5% 86.5% Coverage on New Code
0.0% 0.0% Duplication on New Code

See analysis details on SonarQube

kcreddy

LGTM

elasticmachine · 2024-03-05T21:31:40Z

Package sentinel_one_cloud_funnel - 0.12.0 containing this change is available at https://epr.elastic.co/search?package=sentinel_one_cloud_funnel

elasticmachine · 2024-03-05T21:31:41Z

Package sentinel_one_cloud_funnel - 0.12.0 containing this change is available at https://epr.elastic.co/search?package=sentinel_one_cloud_funnel

Also lower required kibana version.

efd6 added enhancement New feature or request Integration:sentinel_one_cloud_funnel SentinelOne Cloud Funnel Team:Security-Service Integrations Security Service Integrations Team labels Feb 12, 2024

efd6 self-assigned this Feb 12, 2024

efd6 force-pushed the 9086-sentinelone_cloud_funnel branch 2 times, most recently from 72e0edf to 4d9ffde Compare February 12, 2024 20:23

efd6 force-pushed the 9086-sentinelone_cloud_funnel branch 4 times, most recently from 5fe3280 to 1e0b467 Compare February 15, 2024 01:05

efd6 marked this pull request as ready for review February 15, 2024 01:24

efd6 requested a review from a team as a code owner February 15, 2024 01:24

efd6 requested a review from w0rk3r February 15, 2024 01:24

w0rk3r approved these changes Feb 15, 2024

View reviewed changes

tomsonpl reviewed Feb 19, 2024

View reviewed changes

kcreddy approved these changes Feb 21, 2024

View reviewed changes

efd6 added 4 commits March 6, 2024 06:37

sentinel_one_cloud_funnel: improve detection rules support

7e1284f

address pr comment

dda7299

sentinel_one_cloud_funnel: lower kibana.version

5e0c53e

address pr comment

1e79d02

efd6 force-pushed the 9086-sentinelone_cloud_funnel branch from 47ac63c to 1e79d02 Compare March 5, 2024 20:22

efd6 requested a review from kcreddy March 5, 2024 20:24

kcreddy approved these changes Mar 5, 2024

View reviewed changes

efd6 merged commit e42f1fb into elastic:main Mar 5, 2024
5 checks passed

gizas pushed a commit that referenced this pull request Mar 13, 2024

sentinel_one_cloud_funnel: improve detection rules support (#9120)

60dfca3

Also lower required kibana version.

narph added the Category: 3rd EDR label Apr 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sentinel_one_cloud_funnel: improve detection rules support #9120

sentinel_one_cloud_funnel: improve detection rules support #9120

efd6 commented Feb 12, 2024 •

edited

Loading

elasticmachine commented Feb 12, 2024 •

edited

Loading

elasticmachine commented Feb 15, 2024

w0rk3r left a comment

w0rk3r Feb 15, 2024

efd6 Feb 15, 2024

w0rk3r Feb 15, 2024

efd6 Feb 15, 2024

tomsonpl left a comment

tomsonpl Feb 19, 2024

tomsonpl Feb 19, 2024

efd6 Feb 19, 2024

kcreddy left a comment

kcreddy Feb 21, 2024

efd6 Feb 21, 2024

w0rk3r Mar 5, 2024

tomsonpl Mar 5, 2024

elasticmachine commented Mar 5, 2024

elastic-sonarqube bot commented Mar 5, 2024

kcreddy left a comment

elasticmachine commented Mar 5, 2024

elasticmachine commented Mar 5, 2024

sentinel_one_cloud_funnel: improve detection rules support #9120

sentinel_one_cloud_funnel: improve detection rules support #9120

Conversation

efd6 commented Feb 12, 2024 • edited Loading

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

elasticmachine commented Feb 12, 2024 • edited Loading

🚀 Benchmarks report

elasticmachine commented Feb 15, 2024

w0rk3r left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomsonpl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kcreddy left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Mar 5, 2024

💚 Build Succeeded

History

elastic-sonarqube bot commented Mar 5, 2024

Quality Gate passed

kcreddy left a comment

Choose a reason for hiding this comment

elasticmachine commented Mar 5, 2024

elasticmachine commented Mar 5, 2024

efd6 commented Feb 12, 2024 •

edited

Loading

elasticmachine commented Feb 12, 2024 •

edited

Loading