SentinelOne Integration with ELK

[Jayesh_Auti]

Hi Guys,

I am integrating SentinelOne with ELK, after adding console URL and API key it showing me to add elastic agent.

Elastic agent is required for these type of integrations?

Can anyone help me with this?

Thank you,
Jayesh

[Tortoise]

Hello @Jayesh_Auti

Welcome to the Community!!

Yes, elastic agent will be required to collect the data. Similar post :

SentinelOne Integration

Hi @Medel - welcome to the Discuss community! Within Kibana, if you go to Management -> Integrations, you should see the SentinelOne integration there. Once you go to that integration and click 'Add SentintelOne' it will take you to the integration configuration, where you can enter your S1 console URL and API key. [Screenshot 2022-07-22 at 11.03.33] You'll then need to assign the integration to an Elastic Agent to collect the events and ship to Elastic. For more information on Elastic Agent…

Thanks!!

[Jayesh_Auti]

Hi,

Thank you for clarifying.

I will be doing another integrations like AWS WAF, AWS Guard Duty, so for these also I will need seprate elastic agent or the same I can use and where I have to install the elastic agent on the same instance where ELK is hosted or somewhere else?

Thank you,
Jayesh