SentinelOne Singularity

Overview

What Is SentinelOne Singularity?

SentinelOne Singularity is an Endpoint Detection and Response (EDR) platform that helps IT, DevOps, and security teams monitor activity on hosts connected to their network. It monitors endpoints for known threats, alerts security operations when something is wrong, and prevents attackers from deploying malware.

Integration Actions

With Cyber Triage, there are 2 SentinelOne Singularity integration actions:

SentinelOne Singularity can launch Cyber Triage collections remotely using a PowerShell script.
Import SentinelOne Singularity telemetry into Cyber Triage for scoring and analysis.

Whom Is It Built for?

Internal IR teams.

Why Is It Useful?

EDRs will not be the sole source of evidence in your investigation. You’ll need to collect additional artifacts on the hosts you suspect were involved in the incident. This will mean bringing them into your DFIR analysis environment.

Importing SentinelOne telemetry lets you quickly access and analyze data in an investigation platform. This makes investigations faster and more comprehensive.

Where Is It Used?

The Cyber Triage/SentinelOne integration lets you deploy a Cyber Triage collection at scale to many hosts at once or when an alert triggers it. It also allows you to pull in EDR telemetry from SentinelOne into Cyber Triage for analysis.

What Are the Collector Deployment Options?

Push via EDR: Some EDRs can copy one or more files over. The files could be the tool itself or a script that downloads tools. For example, SentinelOne RemoteOps and Windows Defender can store scripts and tools on the central server and push them out as needed. This approach enables the most automation.
Remote Shell: Some EDRs will provide you a remote Powershell prompt (or similar). From there, you can use a command such as “Invoke-WebRequest” to download the scripts or tools from a URL. This approach may require you to configure a web server to host the data and type commands on each system.
Manual Copy: If the target system has file sharing enabled, you can manually copy the files by mounting the remote C$ drive or using various PowerShell file copy commands. This approach requires you to track where you copied the files, and you’ll still need a shell from the EDR at some point to launch those programs.
File Share: Store your DFIR tools on a file share that each host can access. You can then launch the tools from there. Note that permissions can be challenging in some environments depending on what account the EDR runs as.
Baseline: You can include the DFIR tools in the base image on all systems so that they are there in case of an incident. The main challenge to this is making sure the copy on the system is up to date and hasn’t been tampered with. Like the previous approach, you’ll also need to make sure your EDR will give you a shell to launch these programs.

What is required to pull S1 data into Cyber Triage

There are 2 methods of getting S1 data into Cyber Triage:

Export the timeline data from and endpoint (this is in .csv format).
Configure Cyber Triage to connect to the SentinelOne API (in the CT options panel).

What Is the Required Cyber Triage Version?

Team or Team Enterprise.

Additional Links

Blog Post: EDRs don’t collect all DFIR artifacts, but they can help you do it
Documentation: Collect with SentinelOne Singularity
Documentation: Collector Deployer PowerShell Script

*For more information about this integration, contact our sales team: sales@cybertriage.com.

Visit Site