Device Integration: SentinelOne EDR Syslog Integration with aiSIEM

Table of Contents

• Overview
• Prerequisites
• Install the SentinelOne Certificate on Your CCE Server
• Configuration Steps
  • Configure SentinelOne to Send Syslogs to aiSIEM (CCE Component)
  • Configure Syslog Notifications in SentinelOne
• Verification (MSSP Only)

Overview

This guide provides step-by-step instructions to configure SentinelOne EDR to export syslogs to ADR via the CCE (Collection and Control Engine). This integration ensures that security events, alerts, and notifications from SentinelOne are ingested into aiSIEM for advanced analytics, correlation, and threat detection. 

Prerequisites

• SentinelOne EDR is installed and operational.
• ADR CCE (Collection and Control Engine) is installed and accessible.
• Root access on the CCE server.
• SentinelOne certificate installed on your CCE server (recommended with ADR assistance).

Install the SentinelOne Certificate on Your CCE Server

It is advised to install the SentinelOne certificate on the CCE server with ADR’s assistance. Follow the instructions here: Configure TCP over TLS Log Forwarding to the CCE (SSL Certificate and Key Creation)

Configuration Steps

Configure SentinelOne to Send Syslogs to aiSIEM (CCE Component)

1. Log in to the SentinelOne Admin Console.
2. Select your Site.
3. In the left-side menu, click the slider icon to open Settings.
4. Navigate to the INTEGRATIONS tab and configure:
   • Type: Select SYSLOG
   • Enable SYSLOG: Toggle ON
   • Host: Enter your CCE server IP address and port (e.g., CCE_IP:514).
   • TLS: Enable TLS
   • Formatting: Select CEF2
5. Click Save to apply changes.

Configure Syslog Notifications in SentinelOne

1. On the same settings screen, go to the NOTIFICATIONS tab.
2. Under Notification Types, check all options for Syslog Notifications to ensure comprehensive logging (optional but recommended).
3. Click Save if required.
   

Verification (MSSP Only)

• Allow time for logs to propagate from SentinelOne to aiSIEM.
• In the aiSIEM UI, navigate to Logs and Flows > Collection Status or the syslog monitoring panel to confirm log reception.