Skip to content

Commit 6c0b0df

Browse files
mohitjha-elasticmohitjha-elastic
authored
sentinel_one: Enhance ECS mappings and unify fields across all data streams.
Refined and expanded ECS field mappings to ensure consistency across all data streams. Aligned field names and structures with the latest ECS standards to improve interoperability, data quality, and search normalization in Elastic SIEM.
1 parent e34d16f commit 6c0b0df

File tree

46 files changed

+967
-568
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+967
-568
lines changed

‎packages/sentinel_one/changelog.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
11
# newer versions go on top
2+
- version: "2.0.0"
3+
changes:
4+
- description: |
5+
Unified the site, account, and threat-classification field structures under the `sentinel_one.*` namespace
6+
across all data streams, and removed older fields.
7+
type: breaking-change
8+
link: https://github.com/elastic/integrations/pull/15931
9+
- description: Enhanced the ECS mappings across all data streams.
10+
type: enhancement
11+
link: https://github.com/elastic/integrations/pull/15931
212
- version: "1.43.2"
313
changes:
414
- description: Do not log expected empty template results as DEGRADED health in agent or group data streams.

‎packages/sentinel_one/data_stream/activity/_dev/test/pipeline/test-pipeline-activity.log-expected.json‎

Lines changed: 251 additions & 142 deletions
Large diffs are not rendered by default.

‎packages/sentinel_one/data_stream/activity/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -140,10 +140,18 @@ processors:
140140
field: json.groupId
141141
target_field: user.group.id
142142
ignore_missing: true
143+
- set:
144+
field: group.id
145+
copy_from: user.group.id
146+
ignore_empty_value: true
143147
- rename:
144148
field: json.groupName
145149
target_field: user.group.name
146150
ignore_missing: true
151+
- set:
152+
field: group.name
153+
copy_from: user.group.name
154+
ignore_empty_value: true
147155
- rename:
148156
field: json.accountId
149157
target_field: sentinel_one.activity.account.id
@@ -154,7 +162,7 @@ processors:
154162
ignore_missing: true
155163
- rename:
156164
field: json.accountName
157-
target_field: sentinel_one.activity.account.name
165+
target_field: sentinel_one.account.name
158166
ignore_missing: true
159167
- rename:
160168
field: json.agentId
@@ -193,13 +201,17 @@ processors:
193201
field: json.id
194202
target_field: sentinel_one.activity.id
195203
ignore_missing: true
204+
- set:
205+
field: event.id
206+
copy_from: sentinel_one.activity.id
207+
ignore_empty_value: true
196208
- rename:
197209
field: json.siteId
198-
target_field: sentinel_one.activity.site.id
210+
target_field: sentinel_one.site.id
199211
ignore_missing: true
200212
- rename:
201213
field: json.siteName
202-
target_field: sentinel_one.activity.site.name
214+
target_field: sentinel_one.site.name
203215
ignore_missing: true
204216
- rename:
205217
field: json.threatId
@@ -479,11 +491,11 @@ processors:
479491
ignore_missing: true
480492
- rename:
481493
field: json.data.threatClassification
482-
target_field: sentinel_one.activity.data.threat.classification.name
494+
target_field: sentinel_one.threat_classification.name
483495
ignore_missing: true
484496
- rename:
485497
field: json.data.threatClassificationSource
486-
target_field: sentinel_one.activity.data.threat.classification.source
498+
target_field: sentinel_one.threat_classification.source
487499
ignore_missing: true
488500
- rename:
489501
field: json.data.globalStatus

‎packages/sentinel_one/data_stream/activity/fields/fields.yml‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@
77
- name: id
88
type: keyword
99
description: Related account ID (if applicable).
10-
- name: name
11-
type: keyword
12-
description: Related account name (if applicable).
1310
- name: agent
1411
type: group
1512
fields:
@@ -169,9 +166,6 @@
169166
- name: name
170167
type: keyword
171168
description: Threat classification name.
172-
- name: source
173-
type: keyword
174-
description: Threat classification source.
175169
- name: user
176170
type: group
177171
fields:
@@ -198,15 +192,6 @@
198192
- name: id
199193
type: keyword
200194
description: Activity ID.
201-
- name: site
202-
type: group
203-
fields:
204-
- name: id
205-
type: keyword
206-
description: Related site ID (if applicable).
207-
- name: name
208-
type: keyword
209-
description: Related site name (if applicable).
210195
- name: threat
211196
type: group
212197
fields:

‎packages/sentinel_one/data_stream/activity/fields/unified-fields.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
- name: sentinel_one
2+
type: group
3+
fields:
4+
- name: account
5+
type: group
6+
fields:
7+
- name: name
8+
type: keyword
9+
- name: site
10+
type: group
11+
fields:
12+
- name: id
13+
type: keyword
14+
- name: name
15+
type: keyword
16+
- name: threat_classification
17+
type: group
18+
fields:
19+
- name: name
20+
type: keyword
21+
- name: source
22+
type: keyword

‎packages/sentinel_one/data_stream/activity/sample_event.json‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,34 @@
11
{
22
"@timestamp": "2022-04-19T05:14:08.925Z",
33
"agent": {
4-
"ephemeral_id": "10175f71-9c3d-43ea-9326-e2c1fbfed4fa",
5-
"id": "9b7ecf1c-5873-4d71-b82a-5ef8d4ac574e",
6-
"name": "elastic-agent-48880",
4+
"ephemeral_id": "e6b8b354-ed66-48eb-8516-c576417e273c",
5+
"id": "7097c76d-ffaf-4c65-9da9-8da760e67c8a",
6+
"name": "elastic-agent-98755",
77
"type": "filebeat",
8-
"version": "8.18.7"
8+
"version": "8.19.7"
99
},
1010
"data_stream": {
1111
"dataset": "sentinel_one.activity",
12-
"namespace": "26410",
12+
"namespace": "86823",
1313
"type": "logs"
1414
},
1515
"ecs": {
1616
"version": "8.11.0"
1717
},
1818
"elastic_agent": {
19-
"id": "9b7ecf1c-5873-4d71-b82a-5ef8d4ac574e",
20-
"snapshot": false,
21-
"version": "8.18.7"
19+
"id": "7097c76d-ffaf-4c65-9da9-8da760e67c8a",
20+
"snapshot": true,
21+
"version": "8.19.7"
2222
},
2323
"event": {
2424
"agent_id_status": "verified",
2525
"category": [
2626
"configuration"
2727
],
28-
"created": "2025-09-22T11:35:05.641Z",
28+
"created": "2025-11-19T10:35:41.122Z",
2929
"dataset": "sentinel_one.activity",
30-
"ingested": "2025-09-22T11:35:08Z",
30+
"id": "1234567890123456789",
31+
"ingested": "2025-11-19T10:35:44Z",
3132
"kind": "event",
3233
"original": "{\"accountId\":\"3214567890123456789\",\"accountName\":\"Default12\",\"activityType\":1234,\"agentId\":null,\"agentUpdatedVersion\":null,\"comments\":\"True\",\"createdAt\":\"2022-04-19T05:14:08.925421Z\",\"data\":{\"accountName\":\"Default\",\"byUser\":\"API\",\"fullScopeDetails\":\"Account Default\",\"fullScopeDetailsPath\":\"test/default\",\"groupName\":null,\"newValue\":true,\"role\":\"Level\",\"scopeLevel\":\"Account\",\"scopeName\":\"Default\",\"siteName\":null,\"userScope\":\"account\",\"username\":\"API\"},\"description\":\"API\",\"groupId\":null,\"groupName\":null,\"hash\":null,\"id\":\"1234567890123456789\",\"osFamily\":null,\"primaryDescription\":\"The management user API enabled Two factor authentication on the user API.\",\"secondaryDescription\":null,\"siteId\":null,\"siteName\":null,\"threatId\":null,\"updatedAt\":\"2022-04-18T05:14:08.922553Z\",\"userId\":\"1234567890123456789\"}",
3334
"type": [
@@ -44,10 +45,12 @@
4445
]
4546
},
4647
"sentinel_one": {
48+
"account": {
49+
"name": "Default12"
50+
},
4751
"activity": {
4852
"account": {
49-
"id": "3214567890123456789",
50-
"name": "Default12"
53+
"id": "3214567890123456789"
5154
},
5255
"comments": "True",
5356
"data": {

‎packages/sentinel_one/data_stream/agent/_dev/test/pipeline/test-pipeline-agent.log-expected.json‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
"category": [
1010
"host"
1111
],
12+
"id": "13491234512345",
1213
"kind": "event",
1314
"original": "{\"accountId\":\"12345123451234512345\",\"accountName\":\"Account Name\",\"activeDirectory\":{\"computerDistinguishedName\":null,\"computerMemberOf\":[],\"lastUserDistinguishedName\":null,\"lastUserMemberOf\":[]},\"activeThreats\":7,\"agentVersion\":\"12.x.x.x\",\"allowRemoteShell\":true,\"appsVulnerabilityStatus\":\"not_applicable\",\"cloudProviders\":{},\"computerName\":\"user-test\",\"consoleMigrationStatus\":\"N/A\",\"coreCount\":2,\"missingPermissions\":[\"user-action-needed-bluetooth-per\",\"user_action_needed_fda\"],\"cpuCount\":2,\"cpuId\":\"CPU Name\",\"createdAt\":\"2022-03-18T09:12:00.519500Z\",\"detectionState\":null,\"domain\":\"WORKGROUP\",\"encryptedApplications\":false,\"externalId\":\"\",\"externalIp\":\"81.2.69.143\",\"firewallEnabled\":true,\"firstFullModeTime\":null,\"groupId\":\"1234567890123456789\",\"groupIp\":\"81.2.69.144\",\"groupName\":\"Default Group\",\"id\":\"13491234512345\",\"inRemoteShellSession\":false,\"infected\":true,\"installerType\":\".msi\",\"isActive\":true,\"isDecommissioned\":false,\"isPendingUninstall\":false,\"isUninstalled\":false,\"isUpToDate\":true,\"lastActiveDate\":\"2022-03-17T09:51:28.506000Z\",\"lastIpToMgmt\":\"81.2.69.145\",\"lastLoggedInUserName\":\"\",\"licenseKey\":\"\",\"locationEnabled\":true,\"locationType\":\"not_applicable\",\"locations\":null,\"machineType\":\"server\",\"mitigationMode\":\"detect\",\"mitigationModeSuspicious\":\"detect\",\"modelName\":\"Compute Engine\",\"networkInterfaces\":[{\"gatewayIp\":\"81.2.69.145\",\"gatewayMacAddress\":\"00-00-5E-00-53-00\",\"id\":\"1234567890123456789\",\"inet\":[\"81.2.69.144\"],\"inet6\":[\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\"],\"name\":\"Ethernet\",\"physical\":\"00-00-5E-00-53-00\"}],\"networkQuarantineEnabled\":false,\"networkStatus\":\"connected\",\"operationalState\":\"na\",\"operationalStateExpiration\":null,\"osArch\":\"64 bit\",\"osName\":\"Linux Server\",\"osRevision\":\"1234\",\"osStartTime\":\"2022-04-06T08:27:14Z\",\"osType\":\"linux\",\"osUsername\":null,\"rangerStatus\":\"Enabled\",\"rangerVersion\":\"21.x.x.x\",\"registeredAt\":\"2022-04-06T08:26:45.515278Z\",\"remoteProfilingState\":\"disabled\",\"remoteProfilingStateExpiration\":null,\"scanAbortedAt\":null,\"scanFinishedAt\":\"2022-04-06T09:18:21.090855Z\",\"scanStartedAt\":\"2022-04-06T08:26:52.838047Z\",\"scanStatus\":\"finished\",\"siteId\":\"1234567890123456789\",\"siteName\":\"Default site\",\"storageName\":null,\"storageType\":null,\"tags\":{\"sentinelone\":[{\"assignedBy\":\"test-user\",\"assignedAt\":\"2018-02-27T04:49:26.257525Z\",\"key\":\"key123\",\"assignedById\":\"123456789012345678\",\"id\":\"123456789012345678\",\"value\":\"value123\"}]},\"threatRebootRequired\":false,\"totalMemory\":1234,\"updatedAt\":\"2022-04-07T08:31:47.481227Z\",\"userActionsNeeded\":[\"reboot_needed\"],\"uuid\":\"XXX35XXX8Xfb4aX0X1X8X12X343X8X30\"}",
1415
"type": [
@@ -20,6 +21,7 @@
2021
"name": "Default Group"
2122
},
2223
"host": {
24+
"architecture": "64 bit",
2325
"domain": "WORKGROUP",
2426
"geo": {
2527
"city_name": "London",
@@ -63,10 +65,12 @@
6365
]
6466
},
6567
"sentinel_one": {
68+
"account": {
69+
"name": "Account Name"
70+
},
6671
"agent": {
6772
"account": {
68-
"id": "12345123451234512345",
69-
"name": "Account Name"
73+
"id": "12345123451234512345"
7074
},
7175
"active_threats_count": 7,
7276
"agent": {
@@ -146,10 +150,6 @@
146150
"started_at": "2022-04-06T08:26:52.838Z",
147151
"status": "finished"
148152
},
149-
"site": {
150-
"id": "1234567890123456789",
151-
"name": "Default site"
152-
},
153153
"tags": [
154154
{
155155
"assigned_at": "2018-02-27T04:49:26.257Z",
@@ -166,6 +166,10 @@
166166
"reboot_needed"
167167
],
168168
"uuid": "XXX35XXX8Xfb4aX0X1X8X12X343X8X30"
169+
},
170+
"site": {
171+
"id": "1234567890123456789",
172+
"name": "Default site"
169173
}
170174
},
171175
"tags": [

‎packages/sentinel_one/data_stream/agent/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ processors:
4848
ignore_missing: true
4949
- rename:
5050
field: json.accountName
51-
target_field: sentinel_one.agent.account.name
51+
target_field: sentinel_one.account.name
5252
ignore_missing: true
5353
- rename:
5454
field: json.activeDirectory.computerDistinguishedName
@@ -272,6 +272,10 @@ processors:
272272
field: json.id
273273
target_field: sentinel_one.agent.agent.id
274274
ignore_missing: true
275+
- set:
276+
field: event.id
277+
copy_from: sentinel_one.agent.agent.id
278+
ignore_empty_value: true
275279
- set:
276280
field: host.id
277281
copy_from: sentinel_one.agent.agent.id
@@ -611,6 +615,10 @@ processors:
611615
field: json.osArch
612616
target_field: sentinel_one.agent.os.arch
613617
ignore_missing: true
618+
- set:
619+
field: host.architecture
620+
copy_from: sentinel_one.agent.os.arch
621+
ignore_empty_value: true
614622
- rename:
615623
field: json.osName
616624
target_field: host.os.name
@@ -734,11 +742,11 @@ processors:
734742
ignore_missing: true
735743
- rename:
736744
field: json.siteId
737-
target_field: sentinel_one.agent.site.id
745+
target_field: sentinel_one.site.id
738746
ignore_missing: true
739747
- rename:
740748
field: json.siteName
741-
target_field: sentinel_one.agent.site.name
749+
target_field: sentinel_one.site.name
742750
ignore_missing: true
743751
- rename:
744752
field: json.storageName

‎packages/sentinel_one/data_stream/agent/fields/fields.yml‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@
77
- name: id
88
type: keyword
99
description: A reference to the containing account.
10-
- name: name
11-
type: keyword
12-
description: Name of the containing account.
1310
- name: active_directory
1411
type: group
1512
fields:
@@ -269,15 +266,6 @@
269266
- name: status
270267
type: keyword
271268
description: Last scan status.
272-
- name: site
273-
type: group
274-
fields:
275-
- name: id
276-
type: keyword
277-
description: A reference to the containing site.
278-
- name: name
279-
type: keyword
280-
description: Name of the containing site.
281269
- name: storage
282270
type: group
283271
fields:

‎packages/sentinel_one/data_stream/agent/fields/unified-fields.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
- name: sentinel_one
2+
type: group
3+
fields:
4+
- name: account
5+
type: group
6+
fields:
7+
- name: name
8+
type: keyword
9+
- name: site
10+
type: group
11+
fields:
12+
- name: id
13+
type: keyword
14+
- name: name
15+
type: keyword

0 commit comments

Comments
 (0)