S1 Series 5: Auditing, Reporting, and Notifications with SentinelOne

---

Overview

For effective security management, you need visibility into your environment. SentinelOne offers powerful tools for auditing, reporting, and notifications that give you real-time insights, historical data, and alerts on critical events. Today, we’ll explore how to set up and customize these tools to maintain security oversight and ensure compliance.

---

1. Auditing with SentinelOne’s Activity Logs

The Activity Logs in SentinelOne provide a detailed audit trail, recording actions taken across the console. This is essential for both troubleshooting and compliance, as it allows you to track changes and identify any unauthorized actions.

Key Features of Activity Logs

• Comprehensive Log Tracking: SentinelOne records everything from endpoint status updates to policy changes. Each log entry shows the time, user, and action taken.
• Category Filters: Filter logs by categories like Malware Actions, User Activities, Policy Changes, or Threat Management to narrow down the entries you need.
• Event-Specific Information: For each action, the logs capture details like affected endpoints, actions performed, and relevant time stamps.

How to Use Activity Logs for Auditing

1. Track User Actions: Review user activities to monitor access and detect potential insider threats. For instance, flag API token generation events, which could indicate someone attempting unauthorized access.
2. Review Threat Management: Filter logs to display all malware and threat-related actions, which can reveal if threats were adequately contained and resolved.
3. Compliance Reporting: Use logs as part of a compliance audit to show that policies were consistently applied and sensitive endpoints were protected.

Tip: Regularly export activity logs to maintain an offline record of actions. This helps in tracking trends and maintaining long-term visibility for regulatory audits.

---

2. Setting Up Insight Reports for Actionable Data

Insight Reports are SentinelOne’s reporting feature, providing a high-level overview of endpoint health, threat activity, and remediation success. These reports can be customized and scheduled to keep your team and stakeholders informed.

Key Types of Insight Reports

1. Executive Summary: Gives an overview of incidents and actions taken across all endpoints. This is a high-level report, ideal for management.
2. Threat Insights: Focuses on threat detections, showing the number, types, and severities of threats encountered.
3. Mitigation and Response Insights: Displays actions taken on threats, such as quarantine or remediation events, giving a clear picture of your security team’s response activities.

Configuring and Scheduling Reports

1. Go to the Reporting Section: Navigate to Reports > Insight Reports in the console.
2. Select Report Type: Choose from available templates like Threat Insights or Mitigation Reports based on your reporting needs.
3. Customize Report Parameters:
   • Timeframe: Set the reporting period (daily, weekly, monthly).
   • Scope: Choose whether to run the report for specific groups, sites, or tenants.
4. Schedule Reports: Schedule reports to run automatically at regular intervals and email them to key stakeholders.

Best Practice: Run monthly Executive Summary reports to share with senior management, while weekly Threat Insights reports keep the SOC team updated on recent threats.

---

3. Real-Time Notifications and Alerts

SentinelOne’s notification system enables you to configure real-time alerts, which are essential for quick response. You can set up notifications for specific events, actions, or threat detections, ensuring your team remains informed on critical security events.

Configuring Notifications for Key Events

1. Go to Notification Settings: Access the Notifications settings under Settings > Notifications.
2. Set Up Event-Based Alerts:
   • High-Severity Threats: Configure alerts to notify the team immediately when a high-severity threat is detected.
   • Quarantine and Remediation Actions: Trigger alerts whenever SentinelOne automatically quarantines or remediates a threat, so you know critical actions are being taken.
   • Unresolved Threats: Set alerts for threats that remain unresolved for a certain period, highlighting potential gaps in response.
3. Choose Delivery Method:
   • Email Notifications: Use email alerts for events needing quick human intervention.
   • SIEM Integration: Send alerts to your SIEM for central logging, allowing your SOC team to monitor SentinelOne events alongside other system logs.

Tip: Avoid notification overload by focusing on high-impact events (e.g., high-severity threats or quarantine actions) to ensure only relevant alerts reach your team.

Recommended Alerts for SentinelOne

• Immediate Quarantine and Remediation: Get notified when SentinelOne takes containment actions on high-priority endpoints.
• High-Sensitivity Endpoint Threats: Set up alerts for high-severity threats detected on critical endpoints like executive devices or servers.
• System Changes and User Actions: Enable alerts for critical user actions, such as changes in policy settings or API token generation, to monitor for potential misuse.

---

4. Integrating SentinelOne Data with External Systems

For a streamlined response across your security tools, SentinelOne can integrate with other systems, especially SIEMs, for centralized monitoring.

SIEM Integration

1. Configure Syslog Settings: Under Settings > Syslog Integration, enter the IP address and port for your SIEM system.
2. Select Data Types: Choose the data to send, such as Threat Alerts, User Actions, and System Logs.
3. Enable Alerts for SIEM: Configure specific alerts to forward to the SIEM, so your SOC team can monitor SentinelOne incidents along with other event logs.

Tip: Ensure your SIEM is configured to handle SentinelOne log formats, so logs and alerts are parsed accurately for smooth monitoring.

External Reporting for Compliance and Audits

1. Export Reports and Logs: Export key reports and activity logs in formats compatible with compliance audits.
2. Automate Report Sharing: Set up email alerts to automatically send reports to relevant compliance officers or external auditors.

Integrating SentinelOne data with external systems helps maintain a unified security strategy, ensuring alerts and reports from all your tools reach the same team for centralized action.

---

Final Thoughts

Effective security monitoring and compliance management require both in-depth auditing and clear reporting. With SentinelOne’s Activity Logs, Insight Reports, and real-time Notifications, you have the tools to ensure security oversight, compliance, and fast response times.

In summary:

• Use Activity Logs for audit trails and incident analysis.
• Run Insight Reports to keep stakeholders updated on overall endpoint health.
• Configure Notifications to stay informed on critical events in real time.

This concludes the series on S1. By setting up your SentinelOne environment with robust detection, automated response, and ongoing monitoring, you’ve built a comprehensive approach to endpoint security that protects your organization effectively.