From 1157735be16a7892a3eeac1cad2991f042a5a678 Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Fri, 26 Jun 2026 13:20:35 +0200 Subject: [PATCH] feat(sentinelone): re-model OCSF mappers to actor/target semantics Co-Authored-By: Claude Opus 4.8 --- integrations/sentinelone/manifest.yaml | 4 +- .../sentinelone/mappers/get_alerts.yaml | 41 +++++++++------ .../sentinelone/mappers/get_threats.yaml | 52 ++++++++++--------- 3 files changed, 55 insertions(+), 42 deletions(-) diff --git a/integrations/sentinelone/manifest.yaml b/integrations/sentinelone/manifest.yaml index d64943b..0a7a101 100644 --- a/integrations/sentinelone/manifest.yaml +++ b/integrations/sentinelone/manifest.yaml @@ -1,8 +1,8 @@ id: sentinelone name: SentinelOne -version: 1.2.3 +version: 1.2.4 description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan." -changelog: "1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1." +changelog: "1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1." category: endpoint # Per-instance configuration. The scripts build the API base as /web/api/v2.1. diff --git a/integrations/sentinelone/mappers/get_alerts.yaml b/integrations/sentinelone/mappers/get_alerts.yaml index 0809750..213e5e2 100644 --- a/integrations/sentinelone/mappers/get_alerts.yaml +++ b/integrations/sentinelone/mappers/get_alerts.yaml @@ -1,5 +1,5 @@ name: "SentinelOne Alerts → OCSF" -description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF endpoint/file/process/rule fields." +description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF. The initiating (source) process is the actor (actor.*); the process/file acted upon is the target (process.*/file.*)." field_mappings: title: "ruleInfo.name" severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)" @@ -18,17 +18,28 @@ ocsf: - { source_path: "ruleInfo.description", ocsf_field: "rule.desc" } - { source_path: "alertInfo.alertId", ocsf_field: "finding_info.uid" } - { source_path: "alertInfo.dvEventId", ocsf_field: "metadata.original_event_uid" } - # Source process - - { source_path: "sourceProcessInfo.name", ocsf_field: "process.name" } - - { source_path: "sourceProcessInfo.pid", ocsf_field: "process.pid" } - - { source_path: "sourceProcessInfo.filePath", ocsf_field: "process.file.path" } - - { source_path: "sourceProcessInfo.commandline", ocsf_field: "process.cmd_line" } - - { source_path: "sourceProcessInfo.user", ocsf_field: "process.user.name" } - - { source_path: "sourceProcessInfo.integrityLevel", ocsf_field: "process.integrity" } - - { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "file.hashes.sha256" } - - { source_path: "sourceProcessInfo.fileHashSha1", ocsf_field: "file.hashes.sha1" } - - { source_path: "sourceProcessInfo.fileHashMd5", ocsf_field: "file.hashes.md5" } - # Parent process - - { source_path: "sourceParentProcessInfo.name", ocsf_field: "process.parent_process.name" } - - { source_path: "sourceParentProcessInfo.pid", ocsf_field: "process.parent_process.pid" } - - { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "process.parent_process.cmd_line" } + # Initiating (source) process — the actor + - { source_path: "sourceProcessInfo.name", ocsf_field: "actor.process.name" } + - { source_path: "sourceProcessInfo.pid", ocsf_field: "actor.process.pid" } + - { source_path: "sourceProcessInfo.filePath", ocsf_field: "actor.process.file.path" } + - { source_path: "sourceProcessInfo.commandline", ocsf_field: "actor.process.cmd_line" } + - { source_path: "sourceProcessInfo.user", ocsf_field: "actor.user.name" } + - { source_path: "sourceProcessInfo.integrityLevel", ocsf_field: "actor.process.integrity" } + - { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "actor.process.file.hashes.sha256" } + - { source_path: "sourceProcessInfo.fileHashSha1", ocsf_field: "actor.process.file.hashes.sha1" } + - { source_path: "sourceProcessInfo.fileHashMd5", ocsf_field: "actor.process.file.hashes.md5" } + # Parent of the source process + - { source_path: "sourceParentProcessInfo.name", ocsf_field: "actor.process.parent_process.name" } + - { source_path: "sourceParentProcessInfo.pid", ocsf_field: "actor.process.parent_process.pid" } + - { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "actor.process.parent_process.cmd_line" } + # Target process — the process acted upon + - { source_path: "targetProcessInfo.tgtProcName", ocsf_field: "process.name" } + - { source_path: "targetProcessInfo.tgtProcPid", ocsf_field: "process.pid" } + - { source_path: "targetProcessInfo.tgtProcCmdLine", ocsf_field: "process.cmd_line" } + - { source_path: "targetProcessInfo.tgtProcImagePath", ocsf_field: "process.file.path" } + - { source_path: "targetProcessInfo.tgtProcUid", ocsf_field: "process.uid" } + # Target file — the file acted upon + - { source_path: "targetProcessInfo.tgtFilePath", ocsf_field: "file.path" } + - { source_path: "targetProcessInfo.tgtFileId", ocsf_field: "file.uid" } + - { source_path: "targetProcessInfo.tgtFileHashSha256", ocsf_field: "file.hashes.sha256" } + - { source_path: "targetProcessInfo.tgtFileHashSha1", ocsf_field: "file.hashes.sha1" } diff --git a/integrations/sentinelone/mappers/get_threats.yaml b/integrations/sentinelone/mappers/get_threats.yaml index 3ba9536..534fb4d 100644 --- a/integrations/sentinelone/mappers/get_threats.yaml +++ b/integrations/sentinelone/mappers/get_threats.yaml @@ -1,5 +1,5 @@ name: "SentinelOne Threats → OCSF" -description: "Maps a SentinelOne v2.1 threat object (data[]) to OCSF endpoint/file/process/malware fields." +description: "Maps a SentinelOne v2.1 threat object (data[]) to OCSF. The malicious file is the subject (file.*); the process that ran it is the actor (actor.*); the host's logged-in user is the affected user (user.*)." field_mappings: title: "threatInfo.threatName" severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3" @@ -7,27 +7,29 @@ field_mappings: # source_path is evaluated against ONE threat object (alert rule results_path = data). # Paths absent from a given threat are skipped at ingestion, so extra entries are safe. ocsf: - # Endpoint - - { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" } - - { source_path: "agentRealtimeInfo.agentDomain", ocsf_field: "src_endpoint.domain" } - - { source_path: "agentRealtimeInfo.agentOsType", ocsf_field: "src_endpoint.os.type" } - - { source_path: "agentRealtimeInfo.agentUuid", ocsf_field: "device.uid" } - - { source_path: "agentDetectionInfo.externalIp", ocsf_field: "src_endpoint.ip" } - - { source_path: "agentDetectionInfo.agentOsName", ocsf_field: "src_endpoint.os.name" } - - { source_path: "agentDetectionInfo.agentLastLoggedInUserName", ocsf_field: "actor.user.name" } - # Threat / malware - - { source_path: "threatInfo.threatName", ocsf_field: "malware.name" } - - { source_path: "threatInfo.classification", ocsf_field: "malware.classifications" } - - { source_path: "threatInfo.threatId", ocsf_field: "finding_info.uid" } - - { source_path: "threatInfo.confidenceLevel", ocsf_field: "confidence" } - - { source_path: "threatInfo.mitigationStatus", ocsf_field: "status" } - # Process - - { source_path: "threatInfo.processUser", ocsf_field: "process.user.name" } - - { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "process.cmd_line" } - # File - - { source_path: "threatInfo.filePath", ocsf_field: "file.path" } - - { source_path: "threatInfo.fileExtension", ocsf_field: "file.ext" } - - { source_path: "threatInfo.fileSize", ocsf_field: "file.size" } - - { source_path: "threatInfo.sha256", ocsf_field: "file.hashes.sha256" } - - { source_path: "threatInfo.sha1", ocsf_field: "file.hashes.sha1" } - - { source_path: "threatInfo.md5", ocsf_field: "file.hashes.md5" } + # Endpoint (where it was seen) + - { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" } + - { source_path: "agentRealtimeInfo.agentDomain", ocsf_field: "src_endpoint.domain" } + - { source_path: "agentRealtimeInfo.agentOsType", ocsf_field: "src_endpoint.os.type" } + - { source_path: "agentRealtimeInfo.agentUuid", ocsf_field: "device.uid" } + - { source_path: "agentDetectionInfo.externalIp", ocsf_field: "src_endpoint.ip" } + - { source_path: "agentDetectionInfo.agentOsName", ocsf_field: "src_endpoint.os.name" } + # Affected user (logged in on the host) + - { source_path: "agentDetectionInfo.agentLastLoggedInUserName", ocsf_field: "user.name" } + # Finding / malware + - { source_path: "threatInfo.threatName", ocsf_field: "malware.name" } + - { source_path: "threatInfo.classification", ocsf_field: "malware.classifications" } + - { source_path: "threatInfo.threatId", ocsf_field: "finding_info.uid" } + - { source_path: "threatInfo.confidenceLevel", ocsf_field: "confidence" } + - { source_path: "threatInfo.mitigationStatus", ocsf_field: "status" } + # Acting (malicious) process — the actor + - { source_path: "threatInfo.originatorProcess", ocsf_field: "actor.process.name" } + - { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "actor.process.cmd_line" } + - { source_path: "threatInfo.processUser", ocsf_field: "actor.user.name" } + # Malicious file — the subject + - { source_path: "threatInfo.filePath", ocsf_field: "file.path" } + - { source_path: "threatInfo.fileExtension", ocsf_field: "file.ext" } + - { source_path: "threatInfo.fileSize", ocsf_field: "file.size" } + - { source_path: "threatInfo.sha256", ocsf_field: "file.hashes.sha256" } + - { source_path: "threatInfo.sha1", ocsf_field: "file.hashes.sha1" } + - { source_path: "threatInfo.md5", ocsf_field: "file.hashes.md5" }