SentinelOne parser for ESM

[nantic]

Hi,

Is there anyone has expiriance with adding SentinelOne XDR to the ESM like Data source.

https://www.sentinelone.com/

If you have i would be grateful to share your experience with me.

And excample parser for this device 🙂

[YuvrajSalaria]

Dear, SentinelOne is not a supported data source as per the supported data source guide available at below link:

Link: https://docs.mcafee.com/bundle/enterprise-security-manager-data-sources-configuration-reference-guid...

Since, it is not supported, there will not be any parsers related to it on SIEM. If you can create parsers on your own, you might be able to integrate it by selecting Data Source Vendor as 'Generic' and Data Source Model as 'Advanced Syslog Parser'. If you are unable to create parsers on your own, can reach out to McAfee Professional Services.

More information at https://kc.mcafee.com/corporate/index?page=content&id=KB84428

Also, you can submit an Enhancement Request for this:

How to submit a new Product Idea (Product Enhancement Request): https://kc.mcafee.com/corporate/index?page=content&id=KB60021