AnalysisType: rule
Description: "Passthrough SentinelOne Threats "
DisplayName: "SentinelOne Threats"
Enabled: true
Filename: sentinelone_threats.py
Reference: https://www.sentinelone.com/blog/feature-spotlight-introducing-the-new-threat-center/
Severity: Medium
Tests:
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "19"
activityuuid: 123-456-678-89
agentid: "1111112222233333"
createdat: "2022-12-07 16:08:55.703"
data:
accountname: Account1
computername: BobsPC
confidencelevel: malicious
filecontenthash: cf8bd9dfddff007f75adf4c2be48005cea317c62
filedisplayname: eicar.txt
filepath: /home/ubuntu/eicar.txt
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Virus
threatclassificationsource: Cloud
groupid: "12345"
groupname: Testing
id: "11111111"
primarydescription: "Threat with confidence level malicious detected: eicar.txt"
secondarydescription: cf8bd9dfddff007f75adf4c2be48005cea317c62
siteid: "456789"
sitename: Default site
threatid: "123456789"
updatedat: "2022-12-07 16:08:55.698"
Name: malicious event
- ExpectedResult: false
Log:
accountid: "12345"
accountname: Account1
activitytype: "90"
activityuuid: 123-456-789
agentid: "111111"
createdat: "2022-12-07 16:06:35.483"
data:
accountname: Account1
computername: BobsPC
createdat: "2022-12-07T16:06:35.477827Z"
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
scopelevel: Group
scopename: Testing
sitename: Default site
status: started
groupid: "11234"
groupname: Testing
id: "123564"
primarydescription: Agent BobsPC started full disk scan at Wed, 07 Dec 2022, 16:06:35 UTC.
siteid: "12345"
sitename: Default site
updatedat: "2022-12-07 16:06:35.479"
Name: non-threat event
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "19"
activityuuid: 123-456-678-89
agentid: "1111112222233333"
createdat: "2022-12-07 16:08:55.703"
data:
accountname: Account1
computername: BobsPC
confidencelevel: suspicious
filecontenthash: cf8bd9dfddff007f75adf4c2be48005cea317c62
filedisplayname: eicar.txt
filepath: /home/ubuntu/eicar.txt
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Virus
threatclassificationsource: Cloud
groupid: "12345"
groupname: Testing
id: "11111111"
primarydescription: "Threat with confidence level malicious detected: eicar.txt"
secondarydescription: cf8bd9dfddff007f75adf4c2be48005cea317c62
siteid: "456789"
sitename: Default site
threatid: "123456789"
updatedat: "2022-12-07 16:08:55.698"
Name: suspicious event
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "18"
activityuuid: 123-456-678-90
agentid: "1111112222233334"
createdat: "2022-12-07 16:10:00.000"
data:
accountname: Account1
computername: AlicePC
confidencelevel: malicious
filecontenthash: abc123def456789012345678901234567890abcd
filedisplayname: malware.exe
filepath: C:\Users\Alice\Downloads\malware.exe
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Trojan
threatclassificationsource: Engine
groupid: "12345"
groupname: Testing
id: "22222222"
primarydescription: "Threat with confidence level malicious detected and Mitigated: malware.exe"
secondarydescription: abc123def456789012345678901234567890abcd
siteid: "456789"
sitename: Default site
threatid: "987654321"
updatedat: "2022-12-07 16:10:00.000"
Name: mitigated malicious threat
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "20"
activityuuid: 123-456-678-91
agentid: "1111112222233335"
createdat: "2022-12-07 16:15:00.000"
data:
accountname: Account1
computername: CharliePC
confidencelevel: suspicious
filecontenthash: def789abc012345678901234567890123456def0
filedisplayname: suspicious_script.ps1
filepath: C:\Temp\suspicious_script.ps1
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Script
threatclassificationsource: Cloud
groupid: "12345"
groupname: Testing
id: "33333333"
primarydescription: "Threat with confidence level suspicious detected and Mitigated preemptively: suspicious_script.ps1"
secondarydescription: def789abc012345678901234567890123456def0
siteid: "456789"
sitename: Default site
threatid: "567890123"
updatedat: "2022-12-07 16:15:00.000"
Name: preemptive block suspicious threat
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "4110"
activityuuid: 123-456-678-92
agentid: "1111112222233336"
createdat: "2022-12-07 16:20:00.000"
data:
accountname: Account1
computername: DavePC
confidencelevel: malicious
filecontenthash: 1234567890abcdef1234567890abcdef12345678
filedisplayname: ransomware.bin
filepath: /tmp/ransomware.bin
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Ransomware
threatclassificationsource: ThreatIntelligence
groupid: "12345"
groupname: Testing
id: "44444444"
primarydescription: "Singularity Threat Intelligence engine automatically marked event as malicious: ransomware.bin"
secondarydescription: 1234567890abcdef1234567890abcdef12345678
siteid: "456789"
sitename: Default site
threatid: "234567890"
updatedat: "2022-12-07 16:20:00.000"
Name: threat intelligence malicious detection
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "4107"
activityuuid: 123-456-678-93
agentid: "1111112222233337"
createdat: "2022-12-07 16:25:00.000"
data:
accountname: Account1
computername: EvePC
confidencelevel: suspicious
filecontenthash: fedcba0987654321fedcba0987654321fedcba09
filedisplayname: anomalous_process.exe
filepath: C:\Windows\Temp\anomalous_process.exe
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Anomaly
threatclassificationsource: STAR
groupid: "12345"
groupname: Testing
id: "55555555"
primarydescription: "Custom Rule automatically marked event as suspicious: anomalous_process.exe"
secondarydescription: fedcba0987654321fedcba0987654321fedcba09
siteid: "456789"
sitename: Default site
threatid: "345678901"
updatedat: "2022-12-07 16:25:00.000"
Name: star active response suspicious detection
- ExpectedResult: true
Log:
accountid: "123456789"
accountname: Account1
activitytype: "4111"
activityuuid: 123-456-678-94
agentid: "1111112222233338"
createdat: "2022-12-07 16:30:00.000"
data:
accountname: Account1
computername: FrankPC
confidencelevel: malicious
filecontenthash: 0123456789abcdef0123456789abcdef01234567
filedisplayname: cryptominer.exe
filepath: C:\ProgramData\cryptominer.exe
fullscopedetails: Group Testing in Site Default site of Account Account1
fullscopedetailspath: Global / Account1 / Default site / Testing
groupname: Testing
sitename: Default site
threatclassification: Cryptominer
threatclassificationsource: Watchtower
groupid: "12345"
groupname: Testing
id: "66666666"
primarydescription: "Watchtower Cloud Detection engine marked event as threat: cryptominer.exe"
secondarydescription: 0123456789abcdef0123456789abcdef01234567
siteid: "456789"
sitename: Default site
threatid: "456789012"
updatedat: "2022-12-07 16:30:00.000"
Name: watchtower cloud detection
DedupPeriodMinutes: 60
LogTypes:
- SentinelOne.Activity
RuleID: "SentinelOne.Threats"
Threshold: 1
# ------ paired body: sentinelone_threats.py ------
NEW_THREAT_ACTIVITYTYPES = [
# Malicious Threats - Not Mitigated
"19", # New Malicious Threat Not Mitigated
"4108", # New Malicious Threat Not Mitigated (detected by SentinelOne Cloud)
# Suspicious Threats - Not Mitigated
"4003", # New Suspicious Threat Not Mitigated
"4109", # New Suspicious Threat Not Mitigated (detected by SentinelOne Cloud)
# New Threats - Mitigated/Blocked
"18", # New Threat Mitigated
"20", # New Threat Preemptive Block
# Automated Threat Intelligence Detections
"4106", # STAR Active Response Marked Event As Malicious
"4107", # STAR Active Response Marked Event As Suspicious
"4110", # Singularity Threat Intelligence Engine Marked Event As Malicious
"4111", # Watchtower Cloud Detection Engine Marked Event As Threat
"4112", # Watchtower Cloud Detection Engine Marked Event As Suspicious
"4113", # Singularity Threat Intelligence Engine Marked Event As Suspicious
]
def rule(event):
return event.get("activitytype") in NEW_THREAT_ACTIVITYTYPES
def title(event):
return (
f"SentinelOne - [{event.deep_get('data', 'confidencelevel', default='')}] level threat "
f"[{event.deep_get('data', 'filedisplayname', default='NO FILE NAME')}] detected on "
f"[{event.deep_get('data', 'computername', default='NO COMPUTER NAME')}]."
)
def dedup(event):
return f"s1threat:{event.get('id', '')}"
def severity(event):
if event.deep_get("data", "confidencelevel", default="") == "malicious":
return "HIGH"
return "DEFAULT"
def alert_context(event):
return {
"primarydescription": event.get("primarydescription", ""),
"accountname": event.get("accountname", ""),
"accountid": event.get("accountid", ""),
"siteid": event.get("siteid", ""),
"sitename": event.get("sitename", ""),
"threatid": event.get("threatid", ""),
"groupid": event.get("groupid", ""),
"groupname": event.get("groupname", ""),
"activityuuid": event.get("activityuuid", ""),
"agentid": event.get("agentid", ""),
"id": event.get("id", ""),
"data": event.get("data", {}),
}