Integrate SentinelOne EDR solution with SIEM.

[ismailctest C]

Hi,

How to integrate SentinelOne EDR solution with SIEM.

[Pablo Ariel Gonzalez]

Good morning. I guess what you want to do is send SentinelOne events to Wazuh. If so, you could have different alternatives.

• You could use syslog to send the events to wazuh.
• You could also store the events in an S3 bucket and then read them from there.
• You could also read a local file using a wazuh agent if that is a valid alternative for your use case.
• Another option could be to use Wazuh's external API integration to read events and then take action.

If you have any other questions, please feel free to contact us again.

Thanks,

[anonymous]

Could you explain more in depth how to configure syslog to send the events to wazuh from SentinelOne?
At least a rough config of how everything would look like.