SentinelOne Integration

​

Overview

​

Prerequisites

• The Ingest URL — your region’s addEvents endpoint, of the form https://xdr.<region>.sentinelone.net/api/addEvents (the exact host depends on your SDL deployment region).
• A Write API Key — a token authorized to write events into SDL. Treat this as a secret. Ocean places this value in the request body’s token field on every POST.

​

Get the ingest URL and write API key

1. In the SentinelOne console, open Singularity Data Lake (sometimes labeled AI-SIEM or XDR).
2. Navigate to Settings → API Keys (the exact menu name varies by SDL release — look for the screen that lists log-ingest tokens).
3. Note your region in SDL. SentinelOne’s documented ingest hosts are:

   Region	Ingest host
   US	xdr.us1.sentinelone.net
   CA	xdr.ca1.sentinelone.net
   EMEA	xdr.eu1.sentinelone.net
   AP	xdr.ap1.sentinelone.net
   APS	xdr.aps1.sentinelone.net
   AU	xdr.apse2.sentinelone.net

   The full Ingest URL Ocean needs is https://<region-host>/api/addEvents.
4. Create (or copy an existing) Write API Key scoped for event ingestion. Store it securely — Ocean stores it encrypted and never displays it again.

curl -i -X POST \
  -H "Content-Type: application/json" \
  "https://xdr.<region>.sentinelone.net/api/addEvents" \
  -d '{"token":"<YOUR_KEY>","session":"ocean-test","events":[{"ts":"'"$(date +%s)000000000"'","sev":3,"attrs":{"event_type":"test","message":"hello"}}]}'

​

Configure the destination in Ocean

​

How events arrive in SentinelOne

{
  "token": "<write API key>",
  "session": "ocean-<uuid>",
  "sessionInfo": {
    "serverHost": "ocean-security",
    "logfile": "ocean:siem"
  },
  "events": [
    {
      "ts": "1700000000000000000",
      "sev": 3,
      "attrs": {
        "event_id": "...",
        "event_type": "inbound_protection",
        "subject": "URGENT: Wire transfer",
        "verdict": "malicious",
        "sender_address": "alice@example.com",
        "recipient_address": "user@your-org.com",
        "message_internet_message_id": "<CAJ8...@mail.gmail.com>",
        "addressed_to_to": "[\"user@your-org.com\",\"user2@your-org.com\"]",
        "...": "...every other payload field, flattened to a top-level key..."
      }
    }
  ]
}

• token carries your Write API Key — there is no Authorization header.
• session is a stable identifier Ocean generates per sender lifetime.
• sessionInfo.serverHost / sessionInfo.logfile are fixed to ocean-security / ocean:siem so events are always findable and the documented queries (serverHost = 'ocean-security') always hold.
• Each event uses ts in nanoseconds since the UNIX epoch, encoded as a string.
• attrs carries event_id and event_type plus the Ocean event payload fully flattened into top-level scalar columns (see below).
• The Scalyr sev level is always 3 (info). Ocean does not encode the verdict in the lake-level severity — use the verdict field for triage instead.

​

Field structure: everything is flattened

1. Nested objects are flattened with an underscore-joined key. A field at original_email.subject becomes the top-level key original_email_subject; analysis.verdict becomes analysis_verdict; message.internet_message_id becomes message_internet_message_id. When a child key already begins with its parent’s name the duplication is collapsed, so analysis.analysis_reasoning becomes analysis_reasoning (not analysis_analysis_reasoning).
2. Arrays are sent as a single JSON-encoded string. email.recipients arrives as the key email_recipients with a string value like ["user@your-org.com"]. Query these with contains rather than equality.
3. Freeform JSON blobs are kept as a single JSON string. Fields whose shape varies per record — the audit-log details, resource_before, and resource_after snapshots — are not flattened. They arrive as one JSON-encoded string so they don’t explode into unbounded, inconsistent per-property columns. Query them with contains.

​

Normalized aliases

​

Querying

serverHost = 'ocean-security' and verdict = 'malicious'

serverHost = 'ocean-security' and event_type = 'report_phishing' and analysis_verdict = 'malicious'

serverHost = 'ocean-security' and email_recipients contains 'user@your-org.com'

​

Defining alerts

serverHost = 'ocean-security' and verdict = 'malicious'

serverHost = 'ocean-security' and event_type = 'inbound_protection' and verdict = 'malicious' and attack_type contains 'Credential'

​

Troubleshooting