[Security Solution][Endpoint] Change SentinelOne response actions to use `agent.id` instead of `observer.serial_number` #189535

paul-tavares · 2024-07-30T15:34:09Z

Summary

Security Solution impacts

PR updates the SentinelOne response actions to:

use sentinel_one.[data_type].agent.id field to identify the host ID
- With this change, our uses are no longer restricted to creating SIEM alerts only from the logs-sentinel_one.alert* index
- Indexes that currently include the *.agent.id field:
  - logs-sentinel_one.alert*
  - logs-sentinel_one.threat*
  - logs-sentinel_one.activity*
  - logs-sentinel_one.agent*
  - ❗ IMPORTANT ❗ :
    - Environments with a SIEM rule that looks for observable.serial_number field (the field used prior to this PR to identify the agent id in the SentinelOne document) should update the rule to use one of the new fields (see screen capture below)
    - The following impacts were identified during testing for existing deployments that may already be using the SentinelOne bi-directional response actions (currently in Tech. Preview):
      1. User will no longer be able to download the output from a previous get-file command (this was just release 2 weeks ago to serverless).
      2. After an upgrade, if a user opens the console and clicks on the "Response actions history" button to display the host's response actions, they will not see the response actions in the list that were submitted prior to the upgrade. Those, however, will still be displayed in the (global) Response Actions History Log page.
Dev script was updated to create a SIEM rule that looks at both *.alert* and *.threat* indexes
Fixed the output for processes for SentinelOne to NOT display a Zip file passcode for the download (not needed)
Fixed bug that prevented the Host's OS platform icon (linux, windows, macos) from being displayed in the console.

Connector impacts

SentinelOne connector sub-actions were updated to take in agentId as an argument instead of agentUUID

Rule definition showing use of two of the SentinelOne data sources:

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

…gent-id-for-sentinelone-events

…ssible fields

…gent-id-for-sentinelone-events

)

…ID_FIELDS` object

paul-tavares · 2024-07-31T12:36:00Z

/ci

…gent-id-for-sentinelone-events

paul-tavares · 2024-07-31T19:49:24Z

/ci

…gent-id-for-sentinelone-events

pmuellr · 2024-08-01T19:15:40Z

Looks like the only ResponseOps owned change is the snapshot showing the change of a parameter name for the connector.

Just double-checking, for Backward Compatibility / Zero Down Time (BWC/ZDT) concerns, requests to run these connectors is always from the UX, and they are never queued to be run in task manager (for instance, an action on an alert).

As long as that's true, the param name change shouldn't have any BWC / ZDT issues (like a queued connector execution would).

paul-tavares · 2024-08-01T19:27:46Z

Hi @pmuellr ,

Thank you for the review...

Re:

As long as that's true, the param name change shouldn't have any BWC / ZDT issues (like a queued connector execution would).

That is correct. The connector and associated changes are only used from the UI/API in Kibana. Not queued from an action on an alert)

…vents

pmuellr

ResponseOps changes LGTM

Only change was a connector parameter name change (for ResponseOps), which can be a BWC/ZDT issue if a connector is run as an alerting action. However, this connector is not used an an alerting action, only executed via UX. So, it shouldn't have any BWC/ZDT issues.

…entinelone-events' into task/olm-9304-use-agent-id-for-sentinelone-events

…gent-id-for-sentinelone-events

…gent-id-for-sentinelone-events # Conflicts: # x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx

tomsonpl

Thanks for the improvements! I left some comments and one idea - let me know what you think 👍

tomsonpl · 2024-08-05T13:43:25Z

x-pack/plugins/security_solution/common/endpoint/service/response_actions/constants.ts

-  crowdstrike: 'device.id',
+  endpoint: ['agent.id'],
+  sentinel_one: [
+    'sentinel_one.alert.agent.id',


I wonder if this wouldn't make more sense to make this change on the integration side, to map all of these fields to unified 'device.id', as in CrowdStrike ? What do you think @paul-tavares ?

Yeah, that would be great if there was a single place in the ES doc that contained the Agent's ID (which the device.id seems to be it (here)), but I'm not sure how feasible that is. And it would also put a dependency on the external integration to have those changes done first before we could shift over to using it.

Since this change is required in order for us to be able to officially GA the SentinelOne functionality (RBAC is the other required feature), I'm thinking we use this approach of keeping a list of multiple field and maybe adjust again in the future if we ever get the integrations to support a common field. is that cool with you?

I'll take a note to bring this up with the Security integrations team to see what they think.

tomsonpl · 2024-08-05T13:46:56Z

...gins/security_solution/public/common/lib/endpoint/utils/get_agent_type_for_agent_id_field.ts

+      return fieldAgentType as ResponseActionAgentType;
+    }
+  }
+  return 'endpoint';


Do we need a defaulted endpoint I guess it would end up being returned from the if condition anyway right?

I'm not sure I follow - can you clarify what you mean by "...returned from the if condition..."????

FYI: This utility should return a ResponseAcitonAgentType thus endpoint here insures that.

Wouldn't this return endpoint if there is agent.id field?

if (fieldValues.includes(agentIdEcsField)) { return fieldAgentType as ResponseActionAgentType; }

@tomsonpl ,
I might be missing something, but your assumption that agentIdEcsField (argument to the utility function) is actually a valid agent id field is not correct. agentIdEcsField is a string so we don't know if it will match or not against one of the supported agent id fields - thus why we have the return 'endpoint' as the default return value.

tomsonpl · 2024-08-05T13:50:59Z

x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.test.tsx

-          label: 'Agent status',
-        },
+        // Fields used in support of Response Actions
+        ...Object.values(RESPONSE_ACTIONS_ALERT_AGENT_ID_FIELDS)


Q: Is this order dependant? What would happen if there's device.id (crowdstrike field) first, and then agent.id ? Would former get overwritten by the latter?

re: "is this order dependent?"

I'm not sure. I'm not completely clear how this data structure is used in the real code (not the mock here).
This change was a refactor to ensure the prior code remained supported.

ashokaditya

Code looks good to me. I've a few questions but no blockers. Tested it out as well and it works as expected.

ashokaditya · 2024-08-05T12:58:13Z

x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.test.tsx

+        ...Object.values(RESPONSE_ACTIONS_ALERT_AGENT_ID_FIELDS)
+          .flat()


You may want to export and use SUPPORTED_ALERT_FIELDS here and all other instances where you're deriving a flat list from RESPONSE_ACTIONS_ALERT_AGENT_ID_FIELDS.

Will do. Thanks

ashokaditya · 2024-08-05T13:09:42Z

...ecurity_solution/public/flyout/document_details/shared/hooks/use_highlighted_fields.test.tsx

@@ -144,6 +150,7 @@ describe('useHighlightedFields', () => {
  });

  it('should return sentinelone agent id field if data is s1 alert', () => {
+    const agentIdField = RESPONSE_ACTIONS_ALERT_AGENT_ID_FIELDS.sentinel_one[0];


Q. Does this test work only for sentinel_one.alert.agent.id or should this test be updated so it tests for all the sentinel_one field values?

I can change it to loop through all fields and validate them.

ashokaditya · 2024-08-05T17:21:06Z

.../management/components/endpoint_responder/components/header_info/platforms/platform_icon.tsx

 import linuxSvg from './logos/linux.svg';
 import windowsSvg from './logos/windows.svg';
 import macosSvg from './logos/macos.svg';

-export type Platform = 'macos' | 'linux' | 'windows';
+export type Platform = SupportedHostOsType;


We can just substitute SupportedHostOsType instead of Platform wherever Platform is used.

Yeah, we can. I did not do it in this PR in order for it to not get too big, but I will create a follow up PR to do that.

…gent-id-for-sentinelone-events

tomsonpl

Lgtm 👍 , thanks!

…vents

logeekal

Code looks good from investigations side 🚀 .

…vents

kibana-ci · 2024-08-12T15:33:54Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 14095d2

Failed CI Steps

FTR Configs #27

Test Failures

[job] [logs] FTR Configs #27 / managed content Managed Content preventing the user from overwriting managed content maps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	5651	5654	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	20.7MB	20.7MB	+1.7KB

Unknown metric groups

ESLint disabled in files

id	before	after	diff
`securitySolution`	84	85	+1

Total ESLint disabled count

id	before	after	diff
`securitySolution`	619	620	+1

History

💔 Build #227047 failed a9baf77
💚 Build #226162 succeeded a20b963
💔 Build #226076 failed 9cf78f2
💚 Build #225942 succeeded 21f36fd
💚 Build #225844 succeeded a9e5800
💔 Build #225444 failed faaab1e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

paul-tavares added 8 commits July 24, 2024 08:31

New utility function to retrieve field + agent id from event details

eceb6e4

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

5ac25d6

…gent-id-for-sentinelone-events

calculate agentid/field from alert event details using new list of po…

3692616

…ssible fields

fix error in getting s1 agent status when no records exists yet

daa10e9

Add support to agent status client for agent.id

3357aed

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

ff445b6

…gent-id-for-sentinelone-events

Fix getHostPlatform() to ensure ECS values are checked

f8649ac

update S1 response actions client to use agent.id instead of UUID

9b167ca

paul-tavares added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.16.0 labels Jul 30, 2024

paul-tavares self-assigned this Jul 30, 2024

paul-tavares added 4 commits July 30, 2024 11:35

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

6a9b5aa

…gent-id-for-sentinelone-events

Fix CSS property name to avoid UI warnings (feedback from elastic#189127

4f21197

)

Adjust all runtime code to use the new `RESPONSE_ACTIONS_ALERT_AGENT_…

afccf80

…ID_FIELDS` object

remove all uses of RESPONSE_ACTIONS_ALERT_AGENT_ID_FIELD

8fde7b5

paul-tavares added 5 commits July 31, 2024 08:36

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

a34fbad

…gent-id-for-sentinelone-events

Update S1 script to create more robust rule in SIEM

61326c3

fix S1 connector tests

a92ecac

fix tests for S1 actions client

02394ca

tests for getEventDetailsAgentIdField()

d4cf39f

paul-tavares mentioned this pull request Jul 31, 2024

[Request] Update SentinelOne bi-directional response actions instructions with new requirements for setting up the SIEM rule elastic/security-docs#5637

Closed

paul-tavares added 3 commits July 31, 2024 17:02

Fix type in S1 connector

cf88220

Fix failing tests

af6ede3

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

4b6697b

…gent-id-for-sentinelone-events

paul-tavares marked this pull request as ready for review August 1, 2024 13:38

paul-tavares requested review from a team as code owners August 1, 2024 13:38

don't show file zip passcode for SentinelOne processes (not needed)

2e41c4e

Merge branch 'main' into task/olm-9304-use-agent-id-for-sentinelone-e…

f4706e8

…vents

pmuellr approved these changes Aug 1, 2024

View reviewed changes

paul-tavares added 5 commits August 1, 2024 16:27

fix types

95367d9

Merge remote-tracking branch 'origin/task/olm-9304-use-agent-id-for-s…

91d0cb9

…entinelone-events' into task/olm-9304-use-agent-id-for-sentinelone-events

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

faaab1e

…gent-id-for-sentinelone-events

test test

9237015

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

a9e5800

…gent-id-for-sentinelone-events # Conflicts: # x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx

dhurley14 approved these changes Aug 5, 2024

View reviewed changes

tomsonpl reviewed Aug 5, 2024

View reviewed changes

paul-tavares requested a review from tomsonpl August 5, 2024 15:02

ashokaditya approved these changes Aug 5, 2024

View reviewed changes

paul-tavares added 3 commits August 5, 2024 15:59

Improve s1 test in useHightlightedFields()

8b4e21e

Use new SUPPORTED_AGENT_ID_ALERT_FIELDS const

72f3b09

Merge remote-tracking branch 'upstream/main' into task/olm-9304-use-a…

21f36fd

…gent-id-for-sentinelone-events

tomsonpl approved these changes Aug 6, 2024

View reviewed changes

paul-tavares mentioned this pull request Aug 6, 2024

[Defend Workflows][Bug]Linux OS logo is not showing on the Response Console #189785

Closed

paul-tavares enabled auto-merge (squash) August 6, 2024 12:47

paul-tavares disabled auto-merge August 6, 2024 13:51

paul-tavares added 2 commits August 6, 2024 09:51

Merge branch 'main' into task/olm-9304-use-agent-id-for-sentinelone-e…

9cf78f2

…vents

Merge branch 'main' into task/olm-9304-use-agent-id-for-sentinelone-e…

a20b963

…vents

logeekal approved these changes Aug 7, 2024

View reviewed changes

paul-tavares added 2 commits August 12, 2024 08:09

Merge branch 'main' into task/olm-9304-use-agent-id-for-sentinelone-e…

a9baf77

…vents

Merge branch 'main' into task/olm-9304-use-agent-id-for-sentinelone-e…

14095d2

…vents

paul-tavares merged commit 9aa3910 into elastic:main Aug 12, 2024
42 checks passed

paul-tavares deleted the task/olm-9304-use-agent-id-for-sentinelone-events branch August 12, 2024 19:03

kibanamachine added the backport:skip This commit does not require backporting label Aug 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Change SentinelOne response actions to use `agent.id` instead of `observer.serial_number` #189535

[Security Solution][Endpoint] Change SentinelOne response actions to use `agent.id` instead of `observer.serial_number` #189535

paul-tavares commented Jul 30, 2024 •

edited

Loading

paul-tavares commented Jul 31, 2024

paul-tavares commented Jul 31, 2024

pmuellr commented Aug 1, 2024

paul-tavares commented Aug 1, 2024

pmuellr left a comment

tomsonpl left a comment

tomsonpl Aug 5, 2024

paul-tavares Aug 5, 2024

tomsonpl Aug 5, 2024

paul-tavares Aug 5, 2024

tomsonpl Aug 6, 2024

paul-tavares Aug 6, 2024

tomsonpl Aug 5, 2024

paul-tavares Aug 5, 2024

ashokaditya left a comment

ashokaditya Aug 5, 2024

paul-tavares Aug 5, 2024

ashokaditya Aug 5, 2024

paul-tavares Aug 5, 2024

ashokaditya Aug 5, 2024

paul-tavares Aug 5, 2024

tomsonpl left a comment

logeekal left a comment

kibana-ci commented Aug 12, 2024

ESLint disabled in files

Total ESLint disabled count

		...Object.values(RESPONSE_ACTIONS_ALERT_AGENT_ID_FIELDS)
		.flat()

[Security Solution][Endpoint] Change SentinelOne response actions to use agent.id instead of observer.serial_number #189535

[Security Solution][Endpoint] Change SentinelOne response actions to use agent.id instead of observer.serial_number #189535

Conversation

paul-tavares commented Jul 30, 2024 • edited Loading

Summary

Security Solution impacts

Connector impacts

Rule definition showing use of two of the SentinelOne data sources:

Checklist

paul-tavares commented Jul 31, 2024

paul-tavares commented Jul 31, 2024

pmuellr commented Aug 1, 2024

paul-tavares commented Aug 1, 2024

pmuellr left a comment

Choose a reason for hiding this comment

tomsonpl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ashokaditya left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomsonpl left a comment

Choose a reason for hiding this comment

logeekal left a comment

Choose a reason for hiding this comment

kibana-ci commented Aug 12, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

ESLint disabled in files

Total ESLint disabled count

History

[Security Solution][Endpoint] Change SentinelOne response actions to use `agent.id` instead of `observer.serial_number` #189535

[Security Solution][Endpoint] Change SentinelOne response actions to use `agent.id` instead of `observer.serial_number` #189535

paul-tavares commented Jul 30, 2024 •

edited

Loading