Elastic medium stable kql

SentinelOne Alert External Alerts

Generates a detection alert for each SentinelOne alert written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne alerts in the app.

View Source

Detection Logic

event.kind: event and data_stream.dataset: sentinel_one.alert

Field Validations

Loading…

Comments (0)

Loading comments...