This documentation explains Intezer's alert triage, response, and hunting solution for SentinelOne.
You can get clear recommendations for response on every alert in SentinelOne, by having Intezer investigate and triage alerts for you. Here you can learn more about Intezer automates alert triage, reduces false positives, classifies threats, extracts IOCs, and prioritizes response.
- How Intezer works with SentinelOne
- Intezer and SentinelOne Integration Benefits
- Setting up the connection for SentinelOne alerts
- Setting up Intezer's Live Endpoint Scanner
Get a quick overview of how Intezer's solution for SentinelOne works in this quick 3-minute video:
How Intezer works with SentinelOne
- SentinelOne detects malicious activity on an endpoint and creates an alert.
- Intezer fetches the relevant artifacts (files, URLs, processes, memory image) from the endpoint through SentinelOne for analysis and triage.
- Intezer provides analysis results and clear recommendations for every alert in SentinelOne, so your team knows what to do next.
- From Intezer’s analysis result in SentinelOne, you get verdict, malware family information, additional context, and a link to Intezer’s full investigation so you can review, get IOCs, or related threat hunting queries.
- Additional indicators can be added to the SentinelOne blacklist or with a custom detection rule from Intezer to alert and perform an automated response next time those indicators are seen.
- Scan a suspicious endpoint or proactively hunt for traces of advanced in-memory threats (such as fileless and packed malware, malicious code injections, or any unrecognized code) by using Intezer’s Live Endpoint Scanner as a script from inside SentinelOne.
- Threat hunting queries can be extracted from Intezer and used with SentinelOne to hunt for additional indicators across the environment.
Intezer and SentinelOne Integration Benefits
- Triage for every alert and time savings with a unified, automated workflow.
- Transparent analysis and additional context about scanned artifacts including attribution, malware families, indicators of compromise (IOCs), and TTPs mapped to MITRE ATT&CK®.
- Rapid verdicts of both malicious and benign artifacts classified using Intezer’s proprietary genetic analysis solution.
- Auto remediate false positives identified by Intezer’s analysis: based on your pre-defined classifications for SentinelOne alerts, Intezer updates the Analyst Verdict to “False Positive” and updates the Incident Status to “Resolved.”
- Hunt for traces of advanced in-memory threats such as fileless and packed malware, malicious code injections, or any unrecognized code by running Intezer’s Live Endpoint Scanner as a script from inside SentinelOne.
- Out-of-the-box detection content and queries for threat hunting provide immediate time-to-value.
Set up the connection
- Generate your API key from SentinelOne with the following permissions:
- Endpoints View
- Endpoints File Fetch
- Threats View
- Threats Fetch
- Threat File
- Activity Page
- Activity Page View
- Site View
- Threats update analyst verdict
- Threats update incident status
- Deep visibility
- Deep visibility view
- Deep visibility file fetch
- Deep visibility create
- Enter your API Token and Base URL into the connect sources page.
Automated Alert Remediation
Intezer’s auto alert remediation is a feature that automatically closes false positive alerts in your EDR instance based on Intezer’s verdict. The purpose is to reduce false positives and save valuable time for your team, helping you focus on alerts that require deeper investigation.
How does it work?
Any alert that EDR deems to be risky or malicious but Intezer issues a “Trusted” verdict after deeper analysis is considered a “false positive” by Intezer.
All false positive alerts that fall into your pre-configured types (see the section below) are then auto-remediated by Intezer. For these alerts, Intezer changes the initial Analyst Verdict of the alert to “False Positive” and updates the Incident Status to “Resolved”.
What type of alerts are auto-remediated?
Based on a pre-defined configuration, you select the alert classifications that you would like to apply auto-remediation
How to get started?
Contact us at firstname.lastname@example.org with the classifications you would like to auto-remediate. We recommend starting with low-severity classifications such as “PUA” and “Adware”.
In the future, this configuration will be accessible via your Intezer dashboard.
SentinelOne classifications that can be configured:
Example of a False Positive Alert:
Set up Intezer's Live Endpoint Scanner
- Go to Automation in the main menu
- Click on the Script Library tab
- Download the script from our GitHub repository.
- Click on the Upload New Script button, and fill out the following fields:
- Name: "Run Intezer Endpoint Scanner"
- OS Type: Windows
- Script Type: Action
- Upload Script: upload the script
- Check "Input is Required"
- Input instruction: Provide Intezer API key
- Input Example: "api_key"
Manual script execution
There are multiple ways to run the script:
- In the Forensic details, click Actions > Run Script
- In Automation, click the Script Library tab and select a script to run
- In Sentinels > Endpoints, choose one or more Agents. Click Actions and choose Run Script.
Consult SentinelOne documentation under Running a Script for more details
All analysis results are listed on your history page https://analyze.intezer.com/history?tab=endpoint
Required network access