feat(sentinelone): exhaustive OCSF mappers using full catalog (actor/target/registry/network/indicators)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -1,8 +1,8 @@
|
|||||||
id: sentinelone
|
id: sentinelone
|
||||||
name: SentinelOne
|
name: SentinelOne
|
||||||
version: 1.2.4
|
version: 1.3.0
|
||||||
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
|
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
|
||||||
changelog: "1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
|
changelog: "1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
|
||||||
category: endpoint
|
category: endpoint
|
||||||
|
|
||||||
# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
|
# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
|
||||||
|
|||||||
@@ -1,24 +1,50 @@
|
|||||||
name: "SentinelOne Alerts → OCSF"
|
name: "SentinelOne Alerts → OCSF"
|
||||||
description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF. The initiating (source) process is the actor (actor.*); the process/file acted upon is the target (process.*/file.*)."
|
description: "Exhaustive map of a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF. Initiating (source) process = actor (actor.*); the process/file acted upon = target (process.*/file.*); registry, network, indicators and container included."
|
||||||
field_mappings:
|
field_mappings:
|
||||||
title: "ruleInfo.name"
|
title: "ruleInfo.name"
|
||||||
severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
|
severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
|
||||||
description: "alertInfo.eventType"
|
description: "alertInfo.eventType"
|
||||||
# source_path is evaluated against ONE alert object (alert rule results_path = data).
|
# source_path is JSONata over ONE alert object (alert rule results_path = data).
|
||||||
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
|
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
|
||||||
ocsf:
|
ocsf:
|
||||||
# Endpoint
|
# ── Endpoint / device ─────────────────────────────────────────────
|
||||||
- { source_path: "agentDetectionInfo.name", ocsf_field: "src_endpoint.hostname" }
|
- { source_path: "agentDetectionInfo.name", ocsf_field: "src_endpoint.hostname" }
|
||||||
- { source_path: "agentDetectionInfo.osName", ocsf_field: "src_endpoint.os.name" }
|
- { source_path: "agentDetectionInfo.osName", ocsf_field: "src_endpoint.os.name" }
|
||||||
|
- { source_path: "agentDetectionInfo.osFamily", ocsf_field: "src_endpoint.os.type" }
|
||||||
- { source_path: "agentDetectionInfo.osRevision", ocsf_field: "device.os.build" }
|
- { source_path: "agentDetectionInfo.osRevision", ocsf_field: "device.os.build" }
|
||||||
- { source_path: "agentDetectionInfo.uuid", ocsf_field: "device.uid" }
|
- { source_path: "agentDetectionInfo.uuid", ocsf_field: "device.uid" }
|
||||||
# Rule / finding
|
- { source_path: "agentDetectionInfo.machineType", ocsf_field: "device.type" }
|
||||||
|
- { source_path: "agentDetectionInfo.version", ocsf_field: "metadata.product.version" }
|
||||||
|
- { source_path: "agentDetectionInfo.accountId", ocsf_field: "cloud.account.uid" }
|
||||||
|
# ── Network (alertInfo) ───────────────────────────────────────────
|
||||||
|
- { source_path: "alertInfo.srcIp", ocsf_field: "src_endpoint.ip" }
|
||||||
|
- { source_path: "alertInfo.dstIp", ocsf_field: "dst_endpoint.ip" }
|
||||||
|
- { source_path: "alertInfo.dstPort", ocsf_field: "dst_endpoint.port" }
|
||||||
|
- { source_path: "alertInfo.netEventDirection", ocsf_field: "connection_info.direction" }
|
||||||
|
- { source_path: "alertInfo.dnsRequest", ocsf_field: "dns_query.hostname" }
|
||||||
|
# ── Affected login user (alertInfo) ───────────────────────────────
|
||||||
|
- { source_path: "alertInfo.loginsUserName", ocsf_field: "user.name" }
|
||||||
|
- { source_path: "alertInfo.loginAccountDomain", ocsf_field: "user.domain" }
|
||||||
|
- { source_path: "alertInfo.loginAccountSid", ocsf_field: "user.uid" }
|
||||||
|
# ── Rule / finding ────────────────────────────────────────────────
|
||||||
- { source_path: "ruleInfo.name", ocsf_field: "rule.name" }
|
- { source_path: "ruleInfo.name", ocsf_field: "rule.name" }
|
||||||
- { source_path: "ruleInfo.id", ocsf_field: "rule.uid" }
|
- { source_path: "ruleInfo.id", ocsf_field: "rule.uid" }
|
||||||
- { source_path: "ruleInfo.description", ocsf_field: "rule.desc" }
|
- { source_path: "ruleInfo.description", ocsf_field: "rule.desc" }
|
||||||
- { source_path: "alertInfo.alertId", ocsf_field: "finding_info.uid" }
|
- { source_path: "alertInfo.alertId", ocsf_field: "finding_info.uid" }
|
||||||
- { source_path: "alertInfo.dvEventId", ocsf_field: "metadata.original_event_uid" }
|
- { source_path: "alertInfo.dvEventId", ocsf_field: "metadata.original_event_uid" }
|
||||||
# Initiating (source) process — the actor
|
- { source_path: "alertInfo.createdAt", ocsf_field: "finding_info.created_time" }
|
||||||
|
- { source_path: "alertInfo.updatedAt", ocsf_field: "finding_info.modified_time" }
|
||||||
|
- { source_path: "alertInfo.hitType", ocsf_field: "finding_info.analytic.type" }
|
||||||
|
- { source_path: "alertInfo.incidentStatus", ocsf_field: "status" }
|
||||||
|
- { source_path: "alertInfo.analystVerdict", ocsf_field: "status_detail" }
|
||||||
|
# ── Threat-intel indicator (observables) ──────────────────────────
|
||||||
|
- { source_path: "alertInfo.indicatorName", ocsf_field: "observables.name" }
|
||||||
|
- { source_path: "alertInfo.indicatorCategory", ocsf_field: "observables.type" }
|
||||||
|
- { source_path: "alertInfo.tiIndicatorValue", ocsf_field: "observables.value" }
|
||||||
|
# ── Registry (alertInfo) ──────────────────────────────────────────
|
||||||
|
- { source_path: "alertInfo.registryPath", ocsf_field: "reg_key.path" }
|
||||||
|
- { source_path: "alertInfo.registryValue", ocsf_field: "reg_value.data" }
|
||||||
|
# ── Initiating (source) process — the actor ───────────────────────
|
||||||
- { source_path: "sourceProcessInfo.name", ocsf_field: "actor.process.name" }
|
- { source_path: "sourceProcessInfo.name", ocsf_field: "actor.process.name" }
|
||||||
- { source_path: "sourceProcessInfo.pid", ocsf_field: "actor.process.pid" }
|
- { source_path: "sourceProcessInfo.pid", ocsf_field: "actor.process.pid" }
|
||||||
- { source_path: "sourceProcessInfo.filePath", ocsf_field: "actor.process.file.path" }
|
- { source_path: "sourceProcessInfo.filePath", ocsf_field: "actor.process.file.path" }
|
||||||
@@ -28,18 +54,25 @@ ocsf:
|
|||||||
- { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "actor.process.file.hashes.sha256" }
|
- { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "actor.process.file.hashes.sha256" }
|
||||||
- { source_path: "sourceProcessInfo.fileHashSha1", ocsf_field: "actor.process.file.hashes.sha1" }
|
- { source_path: "sourceProcessInfo.fileHashSha1", ocsf_field: "actor.process.file.hashes.sha1" }
|
||||||
- { source_path: "sourceProcessInfo.fileHashMd5", ocsf_field: "actor.process.file.hashes.md5" }
|
- { source_path: "sourceProcessInfo.fileHashMd5", ocsf_field: "actor.process.file.hashes.md5" }
|
||||||
# Parent of the source process
|
# ── Parent of the source process ──────────────────────────────────
|
||||||
- { source_path: "sourceParentProcessInfo.name", ocsf_field: "actor.process.parent_process.name" }
|
- { source_path: "sourceParentProcessInfo.name", ocsf_field: "actor.process.parent_process.name" }
|
||||||
- { source_path: "sourceParentProcessInfo.pid", ocsf_field: "actor.process.parent_process.pid" }
|
- { source_path: "sourceParentProcessInfo.pid", ocsf_field: "actor.process.parent_process.pid" }
|
||||||
- { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "actor.process.parent_process.cmd_line" }
|
- { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "actor.process.parent_process.cmd_line" }
|
||||||
# Target process — the process acted upon
|
# ── Target process — the process acted upon ───────────────────────
|
||||||
- { source_path: "targetProcessInfo.tgtProcName", ocsf_field: "process.name" }
|
- { source_path: "targetProcessInfo.tgtProcName", ocsf_field: "process.name" }
|
||||||
- { source_path: "targetProcessInfo.tgtProcPid", ocsf_field: "process.pid" }
|
- { source_path: "targetProcessInfo.tgtProcPid", ocsf_field: "process.pid" }
|
||||||
- { source_path: "targetProcessInfo.tgtProcCmdLine", ocsf_field: "process.cmd_line" }
|
- { source_path: "targetProcessInfo.tgtProcCmdLine", ocsf_field: "process.cmd_line" }
|
||||||
- { source_path: "targetProcessInfo.tgtProcImagePath", ocsf_field: "process.file.path" }
|
- { source_path: "targetProcessInfo.tgtProcImagePath", ocsf_field: "process.file.path" }
|
||||||
- { source_path: "targetProcessInfo.tgtProcUid", ocsf_field: "process.uid" }
|
- { source_path: "targetProcessInfo.tgtProcUid", ocsf_field: "process.uid" }
|
||||||
# Target file — the file acted upon
|
- { source_path: "targetProcessInfo.tgtProcIntegrityLevel", ocsf_field: "process.integrity" }
|
||||||
|
# ── Target file — the file acted upon ─────────────────────────────
|
||||||
- { source_path: "targetProcessInfo.tgtFilePath", ocsf_field: "file.path" }
|
- { source_path: "targetProcessInfo.tgtFilePath", ocsf_field: "file.path" }
|
||||||
- { source_path: "targetProcessInfo.tgtFileId", ocsf_field: "file.uid" }
|
- { source_path: "targetProcessInfo.tgtFileId", ocsf_field: "file.uid" }
|
||||||
- { source_path: "targetProcessInfo.tgtFileHashSha256", ocsf_field: "file.hashes.sha256" }
|
- { source_path: "targetProcessInfo.tgtFileHashSha256", ocsf_field: "file.hashes.sha256" }
|
||||||
- { source_path: "targetProcessInfo.tgtFileHashSha1", ocsf_field: "file.hashes.sha1" }
|
- { source_path: "targetProcessInfo.tgtFileHashSha1", ocsf_field: "file.hashes.sha1" }
|
||||||
|
- { source_path: "targetProcessInfo.tgtFileCreatedAt", ocsf_field: "file.created_time" }
|
||||||
|
- { source_path: "targetProcessInfo.tgtFileModifiedAt", ocsf_field: "file.modified_time" }
|
||||||
|
# ── Container ─────────────────────────────────────────────────────
|
||||||
|
- { source_path: "containerInfo.name", ocsf_field: "container.name" }
|
||||||
|
- { source_path: "containerInfo.id", ocsf_field: "container.uid" }
|
||||||
|
- { source_path: "containerInfo.image", ocsf_field: "container.image.name" }
|
||||||
|
|||||||
@@ -1,35 +1,52 @@
|
|||||||
name: "SentinelOne Threats → OCSF"
|
name: "SentinelOne Threats → OCSF"
|
||||||
description: "Maps a SentinelOne v2.1 threat object (data[]) to OCSF. The malicious file is the subject (file.*); the process that ran it is the actor (actor.*); the host's logged-in user is the affected user (user.*)."
|
description: "Exhaustive map of a SentinelOne v2.1 threat object (data[]) to OCSF. Malicious file = subject (file.*/malware.*); originating process = actor (actor.*); host's logged-in user = affected user (user.*)."
|
||||||
field_mappings:
|
field_mappings:
|
||||||
title: "threatInfo.threatName"
|
title: "threatInfo.threatName"
|
||||||
severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3"
|
severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3"
|
||||||
description: "threatInfo.classification"
|
description: "threatInfo.classification"
|
||||||
# source_path is evaluated against ONE threat object (alert rule results_path = data).
|
# source_path is JSONata over ONE threat object (alert rule results_path = data).
|
||||||
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
|
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
|
||||||
ocsf:
|
ocsf:
|
||||||
# Endpoint (where it was seen)
|
# ── Endpoint / device ─────────────────────────────────────────────
|
||||||
- { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" }
|
- { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" }
|
||||||
- { source_path: "agentRealtimeInfo.agentDomain", ocsf_field: "src_endpoint.domain" }
|
- { source_path: "agentRealtimeInfo.agentDomain", ocsf_field: "src_endpoint.domain" }
|
||||||
- { source_path: "agentRealtimeInfo.agentOsType", ocsf_field: "src_endpoint.os.type" }
|
- { source_path: "agentRealtimeInfo.agentOsType", ocsf_field: "src_endpoint.os.type" }
|
||||||
|
- { source_path: "agentRealtimeInfo.agentMachineType", ocsf_field: "device.type" }
|
||||||
- { source_path: "agentRealtimeInfo.agentUuid", ocsf_field: "device.uid" }
|
- { source_path: "agentRealtimeInfo.agentUuid", ocsf_field: "device.uid" }
|
||||||
|
- { source_path: "agentRealtimeInfo.agentId", ocsf_field: "device.uid_alt" }
|
||||||
- { source_path: "agentDetectionInfo.externalIp", ocsf_field: "src_endpoint.ip" }
|
- { source_path: "agentDetectionInfo.externalIp", ocsf_field: "src_endpoint.ip" }
|
||||||
|
- { source_path: "agentDetectionInfo.agentIpV4", ocsf_field: "device.ip" }
|
||||||
- { source_path: "agentDetectionInfo.agentOsName", ocsf_field: "src_endpoint.os.name" }
|
- { source_path: "agentDetectionInfo.agentOsName", ocsf_field: "src_endpoint.os.name" }
|
||||||
# Affected user (logged in on the host)
|
- { source_path: "agentDetectionInfo.agentOsRevision", ocsf_field: "device.os.build" }
|
||||||
|
- { source_path: "agentDetectionInfo.agentVersion", ocsf_field: "metadata.product.version" }
|
||||||
|
- { source_path: "agentDetectionInfo.agentRegisteredAt", ocsf_field: "device.first_seen_time" }
|
||||||
|
- { source_path: "agentDetectionInfo.accountName", ocsf_field: "cloud.account.name" }
|
||||||
|
- { source_path: "agentDetectionInfo.accountId", ocsf_field: "cloud.account.uid" }
|
||||||
|
# ── Affected user (logged in on the host) ─────────────────────────
|
||||||
- { source_path: "agentDetectionInfo.agentLastLoggedInUserName", ocsf_field: "user.name" }
|
- { source_path: "agentDetectionInfo.agentLastLoggedInUserName", ocsf_field: "user.name" }
|
||||||
# Finding / malware
|
# ── Finding / malware ─────────────────────────────────────────────
|
||||||
- { source_path: "threatInfo.threatName", ocsf_field: "malware.name" }
|
- { source_path: "threatInfo.threatName", ocsf_field: "malware.name" }
|
||||||
- { source_path: "threatInfo.classification", ocsf_field: "malware.classifications" }
|
- { source_path: "threatInfo.classification", ocsf_field: "malware.classifications" }
|
||||||
- { source_path: "threatInfo.threatId", ocsf_field: "finding_info.uid" }
|
- { source_path: "threatInfo.threatId", ocsf_field: "finding_info.uid" }
|
||||||
|
- { source_path: "threatInfo.createdAt", ocsf_field: "finding_info.created_time" }
|
||||||
|
- { source_path: "threatInfo.identifiedAt", ocsf_field: "finding_info.first_seen_time" }
|
||||||
|
- { source_path: "threatInfo.updatedAt", ocsf_field: "finding_info.modified_time" }
|
||||||
|
- { source_path: "threatInfo.detectionType", ocsf_field: "finding_info.analytic.type" }
|
||||||
- { source_path: "threatInfo.confidenceLevel", ocsf_field: "confidence" }
|
- { source_path: "threatInfo.confidenceLevel", ocsf_field: "confidence" }
|
||||||
- { source_path: "threatInfo.mitigationStatus", ocsf_field: "status" }
|
- { source_path: "threatInfo.incidentStatus", ocsf_field: "status" }
|
||||||
# Acting (malicious) process — the actor
|
- { source_path: "threatInfo.analystVerdict", ocsf_field: "status_detail" }
|
||||||
|
- { source_path: "threatInfo.mitigationStatus", ocsf_field: "status_code" }
|
||||||
|
- { source_path: "threatInfo.storyline", ocsf_field: "metadata.correlation_uid" }
|
||||||
|
# ── Acting (malicious) process — the actor ────────────────────────
|
||||||
- { source_path: "threatInfo.originatorProcess", ocsf_field: "actor.process.name" }
|
- { source_path: "threatInfo.originatorProcess", ocsf_field: "actor.process.name" }
|
||||||
- { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "actor.process.cmd_line" }
|
- { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "actor.process.cmd_line" }
|
||||||
- { source_path: "threatInfo.processUser", ocsf_field: "actor.user.name" }
|
- { source_path: "threatInfo.processUser", ocsf_field: "actor.user.name" }
|
||||||
# Malicious file — the subject
|
# ── Malicious file — the subject ──────────────────────────────────
|
||||||
- { source_path: "threatInfo.filePath", ocsf_field: "file.path" }
|
- { source_path: "threatInfo.filePath", ocsf_field: "file.path" }
|
||||||
- { source_path: "threatInfo.fileExtension", ocsf_field: "file.ext" }
|
- { source_path: "threatInfo.fileExtension", ocsf_field: "file.ext" }
|
||||||
|
- { source_path: "threatInfo.fileExtensionType", ocsf_field: "file.type" }
|
||||||
- { source_path: "threatInfo.fileSize", ocsf_field: "file.size" }
|
- { source_path: "threatInfo.fileSize", ocsf_field: "file.size" }
|
||||||
|
- { source_path: "threatInfo.publisherName", ocsf_field: "file.company_name" }
|
||||||
- { source_path: "threatInfo.sha256", ocsf_field: "file.hashes.sha256" }
|
- { source_path: "threatInfo.sha256", ocsf_field: "file.hashes.sha256" }
|
||||||
- { source_path: "threatInfo.sha1", ocsf_field: "file.hashes.sha1" }
|
- { source_path: "threatInfo.sha1", ocsf_field: "file.hashes.sha1" }
|
||||||
- { source_path: "threatInfo.md5", ocsf_field: "file.hashes.md5" }
|
- { source_path: "threatInfo.md5", ocsf_field: "file.hashes.md5" }
|
||||||
|
|||||||
Reference in New Issue
Block a user