SentinelOne (syslog)

Open in ChatGPTOpen in Claude

Note

Prefer the SentinelOne integration package. It connects over an API token and needs no server of your own. Use this syslog route only when a direct API integration is not an option.

SentinelOne protects endpoints with anti-malware and anti-exploit agents that report to SentinelOne's servers. This page routes those events to Coralogix over syslog: SentinelOne sends to a server you run, an OpenTelemetry Collector on that server parses the syslog stream, and the Coralogix exporter forwards it.

What you need

• Admin access to your Coralogix account.
• Admin access to your SentinelOne account.
• A server to host the log shipper (an EC2 instance or equivalent) reachable from SentinelOne.
• OpenTelemetry installed on that server.
• A Coralogix Send-Your-Data API key.

Create the TLS certificates

SentinelOne authenticates the syslog destination over TLS, so the server needs a certificate chain it can present.

1.

Create a directory for the certificates

On the server, run:

sudo mkdir /etc/certificates && cd /etc/certificates

2.

Create the CA certificate

When prompted for the FQDN, enter the server's public IP address.

openssl genrsa -out RootCA.key 2048
openssl req -x509 -new -nodes -key RootCA.key -sha256 -days 1024 -out RootCA.pem

3.

Write a custom OpenSSL configuration

Create custom_ssl.conf, replacing CN and alt_names with your server's IP address or domain name.

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
CN=<SERVER_IP>
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = <SERVER_IP>

4.

Generate the key and signing request

Run:

openssl genrsa -out SentinelOne.key 2048
openssl req -new -key SentinelOne.key -out SentinelOne.csr -config custom_ssl.conf

5.

Sign the certificate with your CA

Run:

openssl x509 -req -in SentinelOne.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -out SentinelOne.pem -days 1024 -sha256

6.

Make the certificates readable

Run:

sudo chmod +r /etc/certificates/*

Configure the Collector

Create the OpenTelemetry configuration file, substituting these values:

Variable	Description
domain	The Coralogix domain associated with your account
private_key	Your Coralogix Send-Your-Data API key
protocol	The syslog message format SentinelOne sends. rfc3164 or rfc5424

receivers:
  syslog:
    tcp:
      listen_address: "0.0.0.0:514"
      tls:
        cert_file: "/etc/certificates/RootCA.pem"
        key_file: "/etc/certificates/RootCA.key"
        ca_file: "/etc/certificates/RootCA.pem"
    protocol: rfc5424
    operators:
      - type: syslog_parser
        protocol: rfc5424
        parse_from: body
        parse_to: body
      - type: remove
        field: attributes
exporters:
  coralogix:
    domain: "coralogix.com"
    private_key: "your private key"
    application_name: "syslog-application"
    subsystem_name: "syslog-subsystem"
    timeout: 30s
service:
  pipelines:
    logs:
      receivers: [ syslog ]
      exporters: [ coralogix ]

Save the file and start the Collector.

Forward logs from SentinelOne

Note

Ask SentinelOne for the source IP addresses your account sends from, and allow only those in your server's security group. Opening the port to everything gives up the principle of least privilege for no gain.

1.

Open the syslog integration

In the SentinelOne platform, select Settings, then Integrations, then SYSLOG under Types.

2.

Point it at your server

Enter the Host IP address of the server you configured and the port the Collector listens on. Set Formatting to CEF2.

Shows where the syslog destination and its port are set.

3.

Upload the certificates

Select the TLS checkbox, then upload the server certificate, client certificate, and client key you generated.

4.

Test and save

Select Test, then save the syslog integration.

Shows the three upload slots that complete the TLS handshake with your Collector.

Related resources

SentinelOne integration packageCoralogix domainSend-Your-Data API key