Integrate SentinelOne Singularity

You can integrate SentinelOne Singularity with Sophos XDR so that it sends data to Sophos for analysis.

Key steps

The key steps in a SentinelOne Singularity integration are as follows:

• Create a service user and API token in SentinelOne Singularity Endpoint.
• Get the API details from SentinelOne.
• If you want to ingest EDR data, configure a SentinelOne Deep Visibility policy.
• Configure the integration in Sophos XDR and turn on the data sources you want to ingest.

Requirements

The following is required for SentinelOne Singularity configuration:

• An administrator account in SentinelOne Singularity.

To ingest SentinelOne Alerts, you'll also require the following:

• The STAR custom rules feature turned on in your SentinelOne tenant.

To ingest SentinelOne EDR, you'll also require the following:

• The SentinelOne Cloud Funnel add-on. Contact your SentinelOne account representative for Cloud Funnel pricing.
• A service user with Cloud Funnel permissions.
• An account ID.

• A supported SentinelOne region (apne1, apse1, cace1, carvir, euce1, usce1, or usea1).

  If your region is not listed, contact Sophos to request support for it.

Add a SentinelOne Singularity integration

To integrate SentinelOne Singularity, you must first create a service user and API token in SentinelOne Singularity, then provide them in Sophos XDR.

Create a service user and API token

To get the SentinelOne Singularity API details you need for integration, do as follows:

1. Sign in to your SentinelOne Singularity Operations Center.
2. Go to Policies and settings > Service users.
3. In the Actions list, click Create User.
4. In Create New Service User, enter a name and description for the user.
5. For Expiration Date, select a lifespan for the user from the drop-down menu, or click Custom to set a different expiration date and time.
6. Under Permissions, select Account or Site, depending on the desired scope for the integration, then choose the account or site you wish to integrate with Sophos XDR.
7. If you want to ingest EDR data, the service user's role must also include Cloud Funnel permissions. Duplicate the built-in Viewer role, grant Cloud Funnel permissions by choosing Select All, and assign that role to the service user.
8. Click Create Service User.
9. Securely copy the API Token for the service user. You'll need it when you add the integration in Sophos XDR.
10. Click Close.

Next, you configure an integration in Sophos XDR.

Find the account ID

You may wish to scope the integration to a specific account. Find the account ID in the SentinelOne Singularity Operations Center as follows:

1. Sign in to your SentinelOne Singularity Operations Center.
2. Go to Policies and settings > Accounts.
3. Click on the desired account.
4. Copy the Account ID.

Find the site ID (optional)

You may wish to scope the integration to a specific site. Find the site ID in the SentinelOne Singularity Operations Center as follows:

1. Sign in to your SentinelOne Singularity Operations Center.
2. Go to Policies and settings > Sites.
3. Click on the desired site.
4. Copy the Site ID.

Configure a SentinelOne Deep Visibility policy (EDR only)

EDR data is collected through SentinelOne Cloud Funnel 2.0. To ingest EDR data, configure a Deep Visibility policy in SentinelOne so that agents collect and forward the required events to Cloud Funnel. When you turn on the EDR data source in Sophos XDR, Sophos XDR automatically provisions the Cloud Funnel destination (a dedicated Sophos-managed storage location). You don't create or manage that storage yourself. Don't change the Cloud Funnel configuration created by the integration while the integration is in use.

1. Go to Sentinels > Policy and locate the Deep Visibility section.
2. Click Enable Deep Visibility.

3. Select the event categories to collect: Process, DNS, Registry Keys, Command Scripts, File, IP, Scheduled Tasks, Cross Process, URL, Login, Behavioral Indicators, and Module.

   Note

   For the integration to ingest an event category, you must also select all event types in that category under Event Type Configuration. Events that are not turned on in the policy are not collected or forwarded to Sophos XDR.

4. Under XDR Collections, select Windows Event Log. Optionally, also select Windows Event Log Extended.

   Note

   Selecting the Windows Event Log Extended option includes the Windows event log XML, which the integration uses to add more information to the events. Windows Event Log Extended consumes significantly more data than Windows Event Log in SentinelOne and therefore is more costly.

   Refer to the SentinelOne documentation (Windows Event Logs in the SentinelOne Singularity AI SIEM) before turning on these options to understand the cost involved with enabling Windows Event Log Extended and how to configure which Windows event logs you want collected.

5. Click Save Changes.

Configure the integration in Sophos XDR

To integrate SentinelOne Singularity with Sophos XDR, do as follows:

1. In Sophos Fusion, go to Security Operations > Integrations > Marketplace.

2. Click SentinelOne.

   The SentinelOne page opens. You can configure integrations here and see a list of any you've already configured.

3. In Configured integrations, click Add new.

4. In Add an integration, do as follows:

   1. Enter a name for the integration.

   2. Under Endpoint Data Sources, select the SentinelOne data sources you want Sophos XDR to ingest. Available data sources are:

      • SentinelOne Assets
      • SentinelOne Alerts
      • SentinelOne EDR
      • SentinelOne Threats (required)

   3. Enter the Management URL. For example, https://usea1-999-example.sentinelone.net/.

   4. Enter the API Token you copied in SentinelOne Singularity.
   5. Enter the Account ID you copied in SentinelOne Singularity.
   6. (Optional) Enter the Site ID you copied in SentinelOne Singularity.
   7. (EDR only, optional) If you're including SentinelOne EDR in your data sources and you want Sophos XDR to replace an existing Cloud Funnel configuration, select Replace Cloud Funnel.

5. Click Done.

The new integration appears under Configured integrations. If its status icon is a green tick, your data should appear in the Sophos Data Lake after validation.

Additional resources

For more information on configuring SentinelOne Singularity, see the following documents:

• Using the API documentation
• Windows Event Logs in the SentinelOne Singularity AI SIEM