SentinelOne Plugin for Threat Exchange
SentinelOne Plugin for Threat Exchange
This document explains how to configure the SentinelOne integration with the Threat Exchange module of the Netskope Cloud Exchange platform. This integration allows for sharing of URLs and hashes with Netskope. Threat Exchange fetches SHA256 and MD5 hashes, not SHA1 (which is the default hash SentinelOne provides). This plugin also supports sharing of URLs and hashes with SentinelOne.
Prerequisites
To complete this configuration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
- A Netskope Secure Web Gateway subscription for URL sharing.
- A Netskope Cloud Exchange tenant with the Threat Exchange module already configured.
- A SentinelOne account.
Workflow
- Get your SentinelOne Management URL and API token.
- Configure the SentinelOne Plugin.
- Configure sharing for Netskope and SentinelOne.
- Validate the SentinelOne Plugin.
Click play to watch a video about how to configure the plugin.
This video is for v1.0.0. The recent version of this plugin does support sharing of indicators to SentinelOne.
Click play to watch a video about how the plugin works.
- Log in to your SentinelOne dashboard.
- Click on your username on the top right corner, and then click My User.
- Click on API Token Generate.
- Copy the API token and the Management URL. These are needed to configure the SentinelOne plugin.
- In Cloud Exchange, go to Settings and click Plugins.
- Search for and select the SentinelOne Plugin box to open the plugin creation pages.
- Enter and select the Basic Information on the first page:
- Configuration Name: Enter a name appropriate for your integration.Sync Interval: Adjust to environment needs. We recommend not to go below 5 minutes for production environments.
- Click Next.
- Enter your SentinelOne Management URL.
- Enter your SentinelOne API Token.
- You can leave the default settings for the rest of the settings.
- Click Save.
- Go to Threat Exchange and select Sharing. The Sharing page displays the existing relationships for each sharing configuration in grid view as shown below. The Sharing page also has inputs to configure new sharing from one plugin to another.
- Click Add Sharing Configuration, and in the Source Configuration dropdown list, select SentinelOne.
- Select a Business Rule, and then select Netskope for the Destination Configuration. Sharing configurations are unidirectional. data obtained from one plugin is shared with another plugin. To achieve bi- or multi-directional sharing, configure each separately.
- Select a Target. Each plugin will have a different target or destination for the IoC.
- Click Save.
- Repeat steps 2-5, but select Netskope as the Source Configuration and SentinelOne as the Destination Configuration.
- Click Save.
Adding a new sharing configuration on the active source poll will share the existing IoCs of the source configuration to the destination configuration. Whenever a new sharing configuration is built, all the active IoCs will also be considered for sharing if they match the source/destination combination.
Note
Plugins that do not have API for ingesting data cannot receive threat data. This is true of the installed plugin API Source, which provides a bucket associated with an API endpoint for remote 3rd-party systems to push data to. Once a Sharing policy has been added, it takes effect.
After a sharing configuration has been created, the sharing table will show the rule being invoked, the source system providing the potential IoC matches, the destination system that will receive matching IoC, and the target applicable to that rule. Multiple Sharing configurations can be made to support mapping certain IoC to multiple targets even on the system destination system.
Modify, Test, or Delete a Sharing Configuration
Each configuration supports 3 actions:
- Edit the rule by clicking on the pencil icon.
- Test the rule by clicking on the synchronization icon. This tests how many IoC will actually be sent to the destination system based on the timeframe and the rule.
- Delete the rule by clicking on the garbage can icon.
In order to validate the integration you must have alerts on SentinelOne. SentinelOne polling Intervals were defined during plugin configuration.
- Go to Threat Exchange and select Threat IoCs.
- In your Netskope UI, go to Policies > Web > URL List, and select a URL List.
- If data is not being brokered between the platforms, look at the audit logs in Cloud Exchange (menu item found in the left menu of Cloud Exchange).
In Cloud Exchange, click Logging in the bottom of the left panel.
Look through the logs for errors. If unable to successfully troubleshoot, open a support ticket with Netskope.
In order to validate the integration you must have alerts on SentinelOne. SentinelOne polling Intervals were defined during plugin configuration.
- Go to Threat Exchange and select Threat IoCs.
- In your Netskope UI, go to Policies > Web > URL List, and select a URL List.
- If data is not being brokered between the platforms, look at the audit logs in Cloud Exchange (menu item found in the left menu of Cloud Exchange).
In Cloud Exchange, click Logging in the bottom of the left panel.
Look through the logs for errors. If unable to successfully troubleshoot, open a support ticket with Netskope.
