SIEM: SentinelOne Parser

[adem_netsys]

Hi guys,

Anyone has sentinelone parser? It hits NGParser in default and so I can't do any new development.

Thanks

[FSM_FTNT]

SentinelOne is supported https://docs.fortinet.com/document/fortisiem/7.1.3/external-systems-configuration-guide/780558/senti...

Can you provide a sample event so that I can check?

Change/obfuscate any sensitive values before posting.

[adem_netsys]

Hi @FSM_FTNT 

We get logs with the help of api, so it does not come in CEF format.

[FSM_FTNT]

How have you integrated with their API, through the generic HTTP API Poller?

https://docs.fortinet.com/document/fortisiem/7.1.3/external-systems-configuration-guide/412973/gener...

[adem_netsys]

Yes, i did this way.