Skip to main content

SentinelOne

  • Updated

This documentation explains Intezer's alert triage, response, and hunting solution for SentinelOne. 

You can get clear recommendations for response on every alert in SentinelOne, by having Intezer investigate and triage alerts for you. Here you can learn more about Intezer automates alert triage, reduces false positives, classifies threats, extracts IOCs, and prioritizes response.

Get a quick overview of how Intezer's solution for SentinelOne works in this quick 3-minute video:

How Intezer works with SentinelOne

DiagramVersion_SentinelOne__1_.png

  1. SentinelOne detects malicious activity on an endpoint and creates an alert.
  2. Intezer fetches the relevant artifacts (files, URLs, processes, memory image) from the endpoint through SentinelOne for analysis and triage.
  3. Intezer provides analysis results and clear recommendations for every alert in SentinelOne, so your team knows what to do next.
  4. From Intezer’s analysis result in SentinelOne, you get verdict, malware family information, additional context, and a link to Intezer’s full investigation so you can review, get IOCs, or related threat hunting queries.
  5. Additional indicators can be added to the SentinelOne blacklist or with a custom detection rule from Intezer to alert and perform an automated response next time those indicators are seen.
  6. Scan a suspicious endpoint or proactively hunt for traces of advanced in-memory threats (such as fileless and packed malware, malicious code injections, or any unrecognized code) by using Intezer’s Live Endpoint Scanner as a script from inside SentinelOne.
  7. Threat hunting queries can be extracted from Intezer and used with SentinelOne to hunt for additional indicators across the environment.

Intezer and SentinelOne Integration Benefits

  • Triage for every alert and time savings with a unified, automated workflow.
  • Transparent analysis and additional context about scanned artifacts including attribution, malware families, indicators of compromise (IOCs), and TTPs mapped to MITRE ATT&CK®.
  • Rapid verdicts of both malicious and benign artifacts classified using Intezer’s proprietary genetic analysis solution.
  • Auto remediate false positives identified by Intezer’s analysis: based on your pre-defined classifications for SentinelOne alerts, Intezer updates the Analyst Verdict to “False Positive” and updates the Incident Status to “Resolved.”
  • Hunt for traces of advanced in-memory threats such as fileless and packed malware, malicious code injections, or any unrecognized code by running Intezer’s Live Endpoint Scanner as a script from inside SentinelOne.
  • Out-of-the-box detection content and queries for threat hunting provide immediate time-to-value.

Set up the connection

  1. Create a new role in SentinelOne for the integration ("Intezer Integration") with the following permissions:
    • EDR Endpoints
      • View
      • File Fetch
    • EDR Threats
      • View
      • Fetch Threat File
      • Update Analyst Verdict
      • Update Incident Status
      • Threat Actions
    • Activity
      • View
    • Sites
      • View
    • Search
      • View
      • File Fetch
      • Create
  2. Create a new service user in SentinelOne, assign the integration role, and copy its access token (alternatively, you can generate an API token for a console user).
  3. Enter your API Token and Base URL into the connect sources page.

Automated Alert Remediation

Intezer’s auto alert remediation is a feature that automatically closes false positive alerts in your EDR instance based on Intezer’s verdict. The purpose is to reduce false positives and save valuable time for your team, helping you focus on alerts that require deeper investigation.

How does it work?

Any alert that EDR deems to be risky or malicious but Intezer issues a “Trusted” verdict after deeper analysis is considered a “false positive” by Intezer.

All false positive alerts that fall into your pre-configured types (see the section below) are then auto-remediated by Intezer. For these alerts, Intezer changes the initial Analyst Verdict of the alert to “False Positive” and updates the Incident Status to “Resolved”.

How to get started?

Contact us at support@intezer.com with the classifications you would like to auto-remediate. We recommend starting with low-severity classifications such as “PUA” and “Adware”.

What type of alerts are auto-remediated?

Intezer automatically resolves alerts that it detects as "False positive" and have external severity of "Low" or "Medium".

Calculating external severity

SentinelOne does not provide alert severity out of the box. Therefore, Intezer calculates the external severity of the alerts based on SentinelOne's classification:

  • Low severity
    PUA (Potentially Unwanted Application), Adware, Packed, Toolbar, Application Control, Benign

  • Medium severity
    Malware, Linux.Malware, Generic.Heuristic, Hacktool, Spyware, Virus, Cryptominer, Miner, Phishing

  • High severity
    Infostealer, Exploit, Trojan, Worm, Interactive shell, Dropper, Downloader

  • Critical severity
    Ransomware, Backdoor, Rootkit

Example of a False Positive Alert:

S1_auto_remedate.png

Set up Intezer's Live Endpoint Scanner

  1. Go to Automation in the main menu
  2. Click on the Script Library tab
  3. Download the script from our GitHub repository.
  4. Click on the Upload New Script button, and fill out the following fields:
    1. Name: "Run Intezer Endpoint Scanner"
    2. OS Type: Windows
    3. Script Type: Action
    4. Upload Script: upload the script
    5. Check "Input is Required"
    6. Input instruction: Provide Intezer API key
    7. Input Example: "api_key"
      S1_upload_new_script.png

Manual script execution

There are multiple ways to run the script:

  1. In the Forensic details, click Actions > Run Script
  2. In Automation, click the Script Library tab and select a script to run
  3. In Sentinels > Endpoints, choose one or more Agents. Click Actions and choose Run Script.

Consult SentinelOne documentation under Running a Script for more details

All analysis results are listed on your history page https://analyze.intezer.com/history?tab=endpoint

Required network access

Your machine should have direct network access to the following addresses:
  • analyze.intezer.com:443
  • intezerfiles.blob.core.windows.net:443
  • crl.godaddy.com:80
Return to top