Skip to content

Commit 843356f

Browse files
mohitjha-elasticmohitjha-elastic
authored
sentinel_one: Add support for threat event data stream.
Added support for ingesting data through the SentinelOne Threat Event data stream, enabling the collection and parsing of threat-related events for accurate ingestion and processing of security insights. Tested on the live samples collected through the SentinelOne API.
1 parent 43e1a4d commit 843356f

File tree

63 files changed

+8087
-1356
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+8087
-1356
lines changed

‎packages/sentinel_one/_dev/benchmark/rally/threat_event-benchmark.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
description: Benchmark 100000 sentinel_one.threat_event events ingested
3+
data_stream:
4+
name: threat_event
5+
corpora:
6+
generator:
7+
total_events: 100000
8+
template:
9+
type: gotext
10+
path: ./threatevent-benchmark/template.ndjson
11+
config:
12+
path: ./threatevent-benchmark/config.yml
13+
fields:
14+
path: ./threatevent-benchmark/fields.yml

‎packages/sentinel_one/_dev/benchmark/rally/threatevent-benchmark/config.yml‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
fields:
2+
- name: activeContentFileId
3+
cardinality: 1000
4+
- name: activeContentHash
5+
cardinality: 1000
6+
- name: activeContentPath
7+
cardinality: 1000
8+
- name: agentDomain
9+
cardinality: 1000
10+
- name: agentGroupId
11+
cardinality: 1000
12+
- name: agentId
13+
cardinality: 1000
14+
- name: agentIp
15+
cardinality: 1000
16+
- name: agentMachineType
17+
cardinality: 1000
18+
- name: agentName
19+
cardinality: 1000
20+
- name: agentNetworkStatus
21+
cardinality: 1000
22+
- name: agentOs
23+
enum:
24+
- linux
25+
- windows
26+
- macos
27+
- unix
28+
- android
29+
- ios
30+
- name: agentUuid
31+
cardinality: 1000
32+
- name: agentVersion
33+
cardinality: 1000
34+
- name: connectionStatus
35+
cardinality: 1000
36+
- name: direction
37+
cardinality: 1000
38+
- name: dnsRequest
39+
cardinality: 1000
40+
- name: dnsResponse
41+
cardinality: 1000
42+
- name: dstIp
43+
cardinality: 1000
44+
- name: dstPort
45+
range:
46+
min: 0
47+
max: 65535
48+
- name: eventType
49+
cardinality: 1000
50+
- name: fileFullName
51+
cardinality: 1000
52+
- name: fileId
53+
cardinality: 1000
54+
- name: fileMd5
55+
cardinality: 1000
56+
- name: fileSha1
57+
cardinality: 1000
58+
- name: fileSha256
59+
cardinality: 1000
60+
- name: fileSize
61+
range:
62+
min: 1
63+
max: 1000
64+
cardinality: 100
65+
- name: fileType
66+
cardinality: 1000
67+
- name: hasActiveContent
68+
- name: id
69+
range:
70+
min: 100000000000000000
71+
max: 999999999999999999
72+
cardinality: 100000
73+
- name: indicatorCategory
74+
cardinality: 1000
75+
- name: indicatorDescription
76+
cardinality: 1000
77+
- name: indicatorMetadata
78+
cardinality: 1000
79+
- name: indicatorName
80+
cardinality: 1000
81+
- name: loginsBaseType
82+
cardinality: 1000
83+
- name: loginsUserName
84+
cardinality: 1000
85+
- name: md5
86+
cardinality: 1000
87+
- name: networkMethod
88+
cardinality: 1000
89+
- name: networkSource
90+
cardinality: 1000
91+
- name: networkUrl
92+
cardinality: 1000
93+
- name: objectType
94+
cardinality: 1000
95+
- name: oldFileMd5
96+
cardinality: 1000
97+
- name: oldFileName
98+
cardinality: 1000
99+
- name: oldFileSha1
100+
cardinality: 1000
101+
- name: oldFileSha256
102+
cardinality: 1000
103+
- name: parentPid
104+
range:
105+
min: 0
106+
max: 10000
107+
- name: parentProcessGroupId
108+
cardinality: 1000
109+
- name: parentProcessName
110+
cardinality: 1000
111+
- name: parentProcessUniqueKey
112+
cardinality: 1000
113+
- name: pid
114+
range:
115+
min: 0
116+
max: 10000
117+
- name: processCmd
118+
cardinality: 1000
119+
- name: processDisplayName
120+
cardinality: 1000
121+
- name: processGroupId
122+
cardinality: 1000
123+
- name: processImagePath
124+
cardinality: 1000
125+
- name: processImageSha1Hash
126+
cardinality: 1000
127+
- name: processIntegrityLevel
128+
cardinality: 1000
129+
- name: processIsMalicious
130+
- name: processIsRedirectedCommandProcessor
131+
cardinality: 1000
132+
- name: processIsWow64
133+
cardinality: 1000
134+
- name: processName
135+
cardinality: 1000
136+
- name: processRoot
137+
cardinality: 1000
138+
- name: processSessionId
139+
cardinality: 1000
140+
- name: processSubSystem
141+
cardinality: 1000
142+
- name: processUniqueKey
143+
cardinality: 1000
144+
- name: processUserName
145+
cardinality: 1000
146+
- name: protocol
147+
cardinality: 1000
148+
- name: publisher
149+
cardinality: 1000
150+
- name: registryClassification
151+
cardinality: 1000
152+
- name: registryId
153+
cardinality: 1000
154+
- name: registryPath
155+
cardinality: 1000
156+
- name: relatedToThreat
157+
- name: rpid
158+
cardinality: 1000
159+
- name: sha1
160+
cardinality: 1000
161+
- name: sha256
162+
cardinality: 1000
163+
- name: signatureSignedInvalidReason
164+
cardinality: 1000
165+
- name: signedStatus
166+
cardinality: 1000
167+
- name: siteId
168+
cardinality: 1000
169+
- name: siteName
170+
cardinality: 1000
171+
- name: srcIp
172+
cardinality: 1000
173+
- name: srcPort
174+
range:
175+
min: 0
176+
max: 65535
177+
- name: storyline
178+
cardinality: 1000
179+
- name: taskName
180+
cardinality: 1000
181+
- name: taskPath
182+
cardinality: 1000
183+
- name: threatStatus
184+
cardinality: 1000
185+
- name: tid
186+
cardinality: 1000
187+
- name: trueContext
188+
cardinality: 1000
189+
- name: user
190+
cardinality: 1000
191+
- name: verifiedStatus
192+
cardinality: 1000

‎packages/sentinel_one/_dev/benchmark/rally/threatevent-benchmark/fields.yml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
- name: activeContentFileId
2+
type: keyword
3+
- name: activeContentHash
4+
type: keyword
5+
- name: activeContentPath
6+
type: keyword
7+
- name: agentDomain
8+
type: keyword
9+
- name: agentGroupId
10+
type: keyword
11+
- name: agentId
12+
type: keyword
13+
- name: agentInfected
14+
type: boolean
15+
- name: agentIp
16+
type: ip
17+
- name: agentIsActive
18+
type: boolean
19+
- name: agentIsDecommissioned
20+
type: boolean
21+
- name: agentMachineType
22+
type: keyword
23+
- name: agentName
24+
type: keyword
25+
- name: agentNetworkStatus
26+
type: keyword
27+
- name: agentOs
28+
type: keyword
29+
- name: agentUuid
30+
type: keyword
31+
- name: agentVersion
32+
type: keyword
33+
- name: connectionStatus
34+
type: keyword
35+
- name: createdAt
36+
type: date
37+
- name: direction
38+
type: keyword
39+
- name: dnsRequest
40+
type: keyword
41+
- name: dnsResponse
42+
type: keyword
43+
- name: dstIp
44+
type: ip
45+
- name: dstPort
46+
type: long
47+
- name: eventType
48+
type: keyword
49+
- name: fileFullName
50+
type: keyword
51+
- name: fileId
52+
type: keyword
53+
- name: fileMd5
54+
type: keyword
55+
- name: fileSha1
56+
type: keyword
57+
- name: fileSha256
58+
type: keyword
59+
- name: fileSize
60+
type: long
61+
- name: fileType
62+
type: keyword
63+
- name: hasActiveContent
64+
type: boolean
65+
- name: id
66+
type: keyword
67+
- name: indicatorCategory
68+
type: keyword
69+
- name: indicatorDescription
70+
type: keyword
71+
- name: indicatorMetadata
72+
type: keyword
73+
- name: indicatorName
74+
type: keyword
75+
- name: loginsBaseType
76+
type: keyword
77+
- name: loginsUserName
78+
type: keyword
79+
- name: md5
80+
type: keyword
81+
- name: networkMethod
82+
type: keyword
83+
- name: networkSource
84+
type: keyword
85+
- name: networkUrl
86+
type: keyword
87+
- name: objectType
88+
type: keyword
89+
- name: oldFileMd5
90+
type: keyword
91+
- name: oldFileName
92+
type: keyword
93+
- name: oldFileSha1
94+
type: keyword
95+
- name: oldFileSha256
96+
type: keyword
97+
- name: parentPid
98+
type: long
99+
- name: parentProcessGroupId
100+
type: keyword
101+
- name: parentProcessIsMalicious
102+
type: boolean
103+
- name: parentProcessName
104+
type: keyword
105+
- name: parentProcessUniqueKey
106+
type: keyword
107+
- name: pid
108+
type: long
109+
- name: processCmd
110+
type: keyword
111+
- name: processDisplayName
112+
type: keyword
113+
- name: processGroupId
114+
type: keyword
115+
- name: processImagePath
116+
type: keyword
117+
- name: processImageSha1Hash
118+
type: keyword
119+
- name: processIntegrityLevel
120+
type: keyword
121+
- name: processIsMalicious
122+
type: boolean
123+
- name: processIsRedirectedCommandProcessor
124+
type: keyword
125+
- name: processIsWow64
126+
type: keyword
127+
- name: processName
128+
type: keyword
129+
- name: processRoot
130+
type: keyword
131+
- name: processSessionId
132+
type: keyword
133+
- name: processStartTime
134+
type: date
135+
- name: processSubSystem
136+
type: keyword
137+
- name: processUniqueKey
138+
type: keyword
139+
- name: processUserName
140+
type: keyword
141+
- name: protocol
142+
type: keyword
143+
- name: publisher
144+
type: keyword
145+
- name: registryClassification
146+
type: keyword
147+
- name: registryId
148+
type: keyword
149+
- name: registryPath
150+
type: keyword
151+
- name: relatedToThreat
152+
type: boolean
153+
- name: rpid
154+
type: keyword
155+
- name: sha1
156+
type: keyword
157+
- name: sha256
158+
type: keyword
159+
- name: signatureSignedInvalidReason
160+
type: keyword
161+
- name: signedStatus
162+
type: keyword
163+
- name: siteId
164+
type: keyword
165+
- name: siteName
166+
type: keyword
167+
- name: srcIp
168+
type: ip
169+
- name: srcPort
170+
type: long
171+
- name: storyline
172+
type: keyword
173+
- name: taskName
174+
type: keyword
175+
- name: taskPath
176+
type: keyword
177+
- name: threatStatus
178+
type: keyword
179+
- name: tid
180+
type: keyword
181+
- name: trueContext
182+
type: keyword
183+
- name: user
184+
type: keyword
185+
- name: verifiedStatus
186+
type: keyword

0 commit comments

Comments
 (0)