Panther rules: sentinelone

SENTINELONE_SEVERITY = {
    "E_LOW": "LOW",
    "E_MEDIUM": "MEDIUM",
    "E_HIGH": "HIGH",
    "E_CRITICAL": "CRITICAL",
}


def rule(event):
    # "3608" corresponds to new alerts
    return event.get("activitytype") == "3608"


def title(event):
    return (
        "SentinelOne "
        f"[{SENTINELONE_SEVERITY.get(event.deep_get('data', 'severity', default=''))}] "
        f"Alert - [{event.deep_get('data', 'rulename')}]"
    )


def dedup(event):
    return f"s1alerts:{event.get('id')}"


def severity(event):
    return SENTINELONE_SEVERITY.get(event.deep_get("data", "severity", default=""), "MEDIUM")


def alert_context(event):
    data_cleaned = {k: v for k, v in event.get("data", {}).items() if v != ""}
    return {
        "primarydescription": event.get("primarydescription", ""),
        "accountname": event.get("accountname", ""),
        "accountid": event.get("accountid", ""),
        "siteid": event.get("siteid", ""),
        "sitename": event.get("sitename", ""),
        "groupid": event.get("groupid", ""),
        "groupname": event.get("groupname", ""),
        "activityuuid": event.get("activityuuid", ""),
        "agentid": event.get("agentid", ""),
        "id": event.get("id", ""),
        "data": data_cleaned,
    }

AnalysisType: rule
Description: SentinelOne Alert Passthrough
DisplayName: "SentinelOne Alert Passthrough"
Enabled: true
Filename: sentinelone_alert_passthrough.py
Reference: https://www.sentinelone.com/blog/feature-spotlight-introducing-the-new-threat-center/
Severity: High
DedupPeriodMinutes: 60
LogTypes:
  - SentinelOne.Activity
RuleID: "SentinelOne.Alert.Passthrough"
Threshold: 1

NEW_THREAT_ACTIVITYTYPES = [
    # Malicious Threats - Not Mitigated
    "19",  # New Malicious Threat Not Mitigated
    "4108",  # New Malicious Threat Not Mitigated (detected by SentinelOne Cloud)
    # Suspicious Threats - Not Mitigated
    "4003",  # New Suspicious Threat Not Mitigated
    "4109",  # New Suspicious Threat Not Mitigated (detected by SentinelOne Cloud)
    # New Threats - Mitigated/Blocked
    "18",  # New Threat Mitigated
    "20",  # New Threat Preemptive Block
    # Automated Threat Intelligence Detections
    "4106",  # STAR Active Response Marked Event As Malicious
    "4107",  # STAR Active Response Marked Event As Suspicious
    "4110",  # Singularity Threat Intelligence Engine Marked Event As Malicious
    "4111",  # Watchtower Cloud Detection Engine Marked Event As Threat
    "4112",  # Watchtower Cloud Detection Engine Marked Event As Suspicious
    "4113",  # Singularity Threat Intelligence Engine Marked Event As Suspicious
]


def rule(event):
    return event.get("activitytype") in NEW_THREAT_ACTIVITYTYPES


def title(event):
    return (
        f"SentinelOne - [{event.deep_get('data', 'confidencelevel', default='')}] level threat "
        f"[{event.deep_get('data', 'filedisplayname', default='NO FILE NAME')}] detected on "
        f"[{event.deep_get('data', 'computername', default='NO COMPUTER NAME')}]."
    )


def dedup(event):
    return f"s1threat:{event.get('id', '')}"


def severity(event):
    if event.deep_get("data", "confidencelevel", default="") == "malicious":
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    return {
        "primarydescription": event.get("primarydescription", ""),
        "accountname": event.get("accountname", ""),
        "accountid": event.get("accountid", ""),
        "siteid": event.get("siteid", ""),
        "sitename": event.get("sitename", ""),
        "threatid": event.get("threatid", ""),
        "groupid": event.get("groupid", ""),
        "groupname": event.get("groupname", ""),
        "activityuuid": event.get("activityuuid", ""),
        "agentid": event.get("agentid", ""),
        "id": event.get("id", ""),
        "data": event.get("data", {}),
    }

AnalysisType: rule
Description: "Passthrough SentinelOne Threats "
DisplayName: "SentinelOne Threats"
Enabled: true
Filename: sentinelone_threats.py
Reference: https://www.sentinelone.com/blog/feature-spotlight-introducing-the-new-threat-center/
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - SentinelOne.Activity
RuleID: "SentinelOne.Threats"
Threshold: 1