| 1 | # SentinelOne Syslog Forwarding |
| 2 | |
| 3 | This process involves configuring SentinelOne to send alerts and events to an external syslog server via TLS-encrypted connection. |
| 4 | |
| 5 | ## Overview |
| 6 | |
| 7 | SentinelOne provides cloud-based endpoint protection and uses a syslog forwarder to send security events to your SIEM stack. The integration requires: |
| 8 | |
| 9 | - **TLS Encryption:** Secure, encrypted log forwarding from SentinelOne cloud endpoints |
| 10 | - **Mutual Authentication:** Client certificate for TLS mutual authentication |
| 11 | - **Cloud-to-Cloud:** Direct forwarding from SentinelOne cloud infrastructure to your SIEM stack |
| 12 | |
| 13 | For detailed instructions, refer to the [SentinelOne Syslog Forwarder Configuration Guide](https://socfortress.supportbench.net/article/sentinelone-syslog-forwarder-to-siem-stack). |
| 14 | |
| 15 | ## Architecture |
| 16 | |
| 17 | ``` |
| 18 | SentinelOne Cloud > TLS (Mutual Auth) > SIEM Stack |
| 19 | ``` |
| 20 | |
| 21 | --- |
| 22 | |
| 23 | ## Step 1: Accessing SentinelOne Management Console |
| 24 | |
| 25 | Log in to your SentinelOne management console: |
| 26 | |
| 27 | - Open a web browser |
| 28 | - Navigate to your SentinelOne console URL (e.g., `https://console.sentinelone.net`) |
| 29 | - Enter your administrative credentials to log in |
| 30 | |
| 31 | ## Step 2: Navigate to Integrations |
| 32 | |
| 33 | Once logged in, follow these steps to configure syslog forwarding: |
| 34 | |
| 35 | - **Navigate to Integrations** |
| 36 | - Go to **Settings** > **Integrations** in the left-hand navigation menu |
| 37 | - Look for the **Syslog** integration option |
| 38 | |
| 39 | ## Step 3: Configure Syslog Forwarder |
| 40 | |
| 41 | Configure the syslog forwarder with the following parameters: |
| 42 | |
| 43 | - **Syslog Host Configuration** |
| 44 | - **Host:** Enter the FQDN or IP address of your SIEM stack (e.g., `firehose.mycompany.com`) |
| 45 | - **Port:** Enter the TCP port provided by SOCFortress staff (typically 6514 for TLS) |
| 46 | |
| 47 | - **Enable TLS Secure Connection** |
| 48 | - Check the box to **Use TLS secure connection** |
| 49 | |
| 50 | - **Upload TLS Certificates** |
| 51 | |
| 52 | You will need to upload three certificate files (provided by SOCFortress via your Onehub account): |
| 53 | |
| 54 | 1. **Root CA Certificate** (`rootCA.mycompany.local.crt`) |
| 55 | - The root Certificate Authority public key |
| 56 | |
| 57 | 2. **Client Certificate** (`syslog_client.mycompany.local.pem`) |
| 58 | - The TLS client certificate public key |
| 59 | |
| 60 | 3. **Private Key** (`syslog_client.mycompany.local.key`) |
| 61 | - The TLS client certificate private key |
| 62 | |
| 63 | - **Log Format** |
| 64 | - Select **RFC-5424** as the syslog format |
| 65 | |
| 66 | ## Step 4: Configure Firewall Rules |
| 67 | |
| 68 | Before testing connectivity, ensure proper firewall rules are in place: |
| 69 | |
| 70 | ### Inbound Firewall Rules |
| 71 | |
| 72 | SentinelOne forwards alerts and events from their cloud endpoints. Configure the following firewall rules: |
| 73 | |
| 74 | #### Rule 1: SentinelOne Cloud to Edge Firewall |
| 75 | |
| 76 | | **SRC IP** | **DST IP** | **PORT** | **FIREWALL ACTION** | **DESCRIPTION** | |
| 77 | |------------|------------|----------|---------------------|-----------------| |
| 78 | | SentinelOne Cloud Endpoints | Your edge firewall's public IP | Provided by SOCFortress | Port Forward to Reverse Proxy (DMZ) | Allow Syslog Forwarder from SentinelOne | |
| 79 | |
| 80 | > **Note:** Contact SentinelOne support to determine the specific source IP addresses/cloud endpoints for your region. |
| 81 | |
| 82 | #### Rule 2: SIEM Stack DMZ to SIEM Stack Internal |
| 83 | |
| 84 | | **SRC IP** | **DST IP** | **PORT** | **FIREWALL ACTION** | **DESCRIPTION** | |
| 85 | |------------|------------|----------|---------------------|-----------------| |
| 86 | | HAProxy DMZ | Graylog Server (01/02) | Provided by SOCFortress | Allow | Allow Syslog traffic DMZ > Internal | |
| 87 | |
| 88 | ## Step 5: Configure Event and Alert Forwarding |
| 89 | |
| 90 | Define which events and alerts should be forwarded to your SIEM: |
| 91 | |
| 92 | - **Navigate to Notifications** |
| 93 | - Go to the **Notifications** tab in the Syslog integration settings |
| 94 | |
| 95 | - **Select Event Types** |
| 96 | |
| 97 | Choose the alerts and events to forward. Common selections include: |
| 98 | - Threat Detections |
| 99 | - Threat Mitigations |
| 100 | - Agent Activity |
| 101 | - Policy Changes |
| 102 | - User Actions |
| 103 | - System Events |
| 104 | - And any other relevant security events |
| 105 | |
| 106 | - **Apply Configuration** |
| 107 | - Click **Save** or **Apply** to activate the forwarding configuration |
| 108 | |
| 109 | ## Step 6: Test the Connection |
| 110 | |
| 111 | After configuring all settings and firewall rules: |
| 112 | |
| 113 | - Click **Test Connection** in the SentinelOne syslog integration interface |
| 114 | - Verify successful TLS handshake and authentication |
| 115 | - Confirm test events are received in your SIEM stack |
| 116 | |
| 117 | ## Step 7: Verify Log Reception |
| 118 | |
| 119 | Monitor your SIEM stack to ensure logs are being received: |
| 120 | |
| 121 | - Check that SentinelOne events appear in your log management system |
| 122 | - Verify proper parsing and categorization of events |
| 123 | - Confirm all selected event types are being forwarded |
| 124 | - Monitor for any connection errors or certificate issues |
| 125 | |
| 126 | --- |
| 127 | |
| 128 | ## Additional Considerations |
| 129 | |
| 130 | - **Certificate Management** |
| 131 | - Keep TLS certificates up to date and properly secured |
| 132 | - Certificates must be in PEM format |
| 133 | - Ensure certificate expiration dates are monitored |
| 134 | - Plan for certificate renewal before expiration |
| 135 | |
| 136 | - **Source IP Addresses** |
| 137 | - SentinelOne uses cloud endpoints that vary by region |
| 138 | - Contact SentinelOne support for specific IP ranges for your deployment |
| 139 | - Update firewall rules if SentinelOne changes their endpoint IPs |
| 140 | |
| 141 | - **High Availability** |
| 142 | - Consider configuring backup syslog destinations if supported |
| 143 | - Ensure redundant firewall paths for critical log forwarding |
| 144 | - Monitor connection health and implement alerting for failures |
| 145 | |
| 146 | - **Log Volume** |
| 147 | - Monitor the volume of logs being generated |
| 148 | - Ensure your SIEM infrastructure can handle the load |
| 149 | - Adjust event filtering if necessary to manage data volume |
| 150 | |
| 151 | - **Security** |
| 152 | - TLS mutual authentication provides strong security |
| 153 | - Protect private keys and restrict access |
| 154 | - Regularly audit firewall rules for unauthorized changes |
| 155 | |
| 156 | - **Time Synchronization** |
| 157 | - Ensure all systems (SentinelOne, SIEM stack) use synchronized time via NTP |
| 158 | - Accurate timestamps are critical for security event correlation |
| 159 | |
| 160 | - **Testing** |
| 161 | - Perform initial testing during a maintenance window |
| 162 | - Verify all expected event types are being received |
| 163 | - Test connection recovery after network interruptions |
| 164 | - Validate TLS certificate authentication is working correctly |
| 165 | |
| 166 | - **Documentation** |
| 167 | - Keep records of: |
| 168 | - Certificate locations and expiration dates |
| 169 | - Firewall rule configurations |
| 170 | - Port assignments |
| 171 | - Selected event types for forwarding |
| 172 | |
| 173 | --- |
| 174 | |
| 175 | ## Troubleshooting |
| 176 | |
| 177 | Common issues and solutions: |
| 178 | |
| 179 | - **Connection Failures** |
| 180 | - Verify firewall rules allow traffic from SentinelOne cloud endpoints |
| 181 | - Check that the destination port is correct and open |
| 182 | - Ensure certificates are correctly uploaded and not expired |
| 183 | |
| 184 | - **Certificate Errors** |
| 185 | - Verify certificate format is PEM |
| 186 | - Ensure the certificate chain is complete (root CA + client cert) |
| 187 | - Check that private key matches the client certificate |
| 188 | |
| 189 | - **Missing Events** |
| 190 | - Confirm event types are selected in the Notifications tab |
| 191 | - Verify SentinelOne agents are properly configured and reporting |
| 192 | - Check SIEM stack for parsing or ingestion errors |
| 193 | |
| 194 | - **Performance Issues** |
| 195 | - Monitor log volume and adjust retention policies |
| 196 | - Consider implementing log filtering for high-volume event types |
| 197 | - Ensure adequate resources on SIEM infrastructure |