Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SentinelOne filter query #9

Open
J0HAN85 opened this issue Dec 21, 2023 · 0 comments
Open

SentinelOne filter query #9

J0HAN85 opened this issue Dec 21, 2023 · 0 comments

Comments

@J0HAN85
Copy link

J0HAN85 commented Dec 21, 2023

The SentinelOne AuthZ source uses the default filter %{Connection:Client-Mac-Address-Colon}

In some cases the MAC address is not found in S1 because the endpoint is connected trough LAN instead of WiFi or connected using an USB-C docking. So the MAC address doesn't match any endpoint.
I can also use a value from our Active Directory (our Authentication Source) to query S1. The API offers this functionality.
However, when I change the filter to %{Authorization:CARE4GO:UserDN} it receives an HTTP 404 from the extension.

The log then show me this message;

[INFO] SentinelOne - [?adQuery__contains=CN=ID0019932,OU=ouComputers,OU=ouNL,DC=care4go,DC=nl] Request for information received from ::ffff:172.17.0.1.
[DEBUG] SentinelOne - [?adQuery__contains=CN=ID0019932,OU=ouComputers,OU=ouNL,DC=care4go,DC=nl] Performing device lookup
[DEBUG] SentinelOne - 1874580b-d165-41de-8f9e-664c97666bcc Request "GET 'agents'" took 204 ms.
[INFO] SentinelOne - [?adQuery__contains=CN=ID0019932,OU=ouComputers,OU=ouNL,DC=care4go,DC=nl] Device not found.

I'm pretty sure the extension could be capable of querying the S1 API using the UserDN, ComputerDN or HostName.
Is this option available and if not, can the extension by modified to allow this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant