SentinelOne

Added Endpoint Filters for SentinelOne Application Risk

• Endpoint Name, Endpoint UUID

Support for SentinelOne Cloud Funnel log collector and a dedicated UI

• New log schemas: sentinelone-application-endpoint, sentinelone-application-risk, sentinelone-cross-process-event, sentinelone-dns-event, sentinelone-file-event, sentinelone-group-event, sentinelone-indicator-event, sentinelone-login-event, sentinelone-process-event, sentinelone-registry-event, sentinelone-scheduled-task-event, sentinelone-session, sentinelone-threat, sentinelone-threat-notes, sentinelone-threat-timeline, sentinelone-vuln-event, sentinelone-webfilter
• New query commands: sentinelone-add-threat-note, sentinelone-app-cves, sentinelone-app-endpoints, sentinelone-app-risks, sentinelone-delete-threat-note, sentinelone-events, sentinelone-query, sentinelone-star-custom-rules, sentinelone-threat-notes, sentinelone-threat-timeline, sentinelone-threats, sentinelone-update-threat-note

Support SentinelOne activity log

• Query command, logger, log schema, and dashboard for SentinelOne activity logs.

First release

• SentinelOne alert logger, logger models, and 9 log schemas.
• SentinelOne agent, alert, and application dashboards.
• SentinelOne extended query commands
  • sentinelone-alerts
  • sentinelone-agents
  • sentinelone-users
  • sentinelone-endpoint-apps
  • sentinelone-endpoint-apps-batch