SentinelOne Deep Visibility Integration

Send SentinelOne Deep Visibility Events to Realm

This guide walks you through connecting SentinelOne Deep Visibility events to Realm. The integration uses Cloud Funnel 2.0 — SentinelOne streams telemetry data directly to a customer-owned AWS S3 bucket, which Realm polls to retrieve endpoint events and forward them through your data pipeline to your configured destination.

Prerequisites

• A SentinelOne account with administrator access
• Access to the AWS Console with permissions to create S3 buckets and SQS queues
• Access to the Realm Security console

Create an S3 Bucket

Cloud Funnel 2.0 requires a customer-owned S3 bucket to stream telemetry into.

1. Go to the AWS Console and navigate to S3.
2. Click Create bucket.
3. Enter a globally unique bucket name (e.g., my-org-sentinelone-cloudfunnel) and select your preferred region.
4. Leave all other settings at their defaults and click Create bucket.

Note: Take note of the bucket name and region — you will need both when configuring Cloud Funnel in SentinelOne.

Configure S3 Event Notifications

Realm supports two approaches for receiving logs from an S3 bucket:

• Option 1 — Via SQS (S3 → SQS): Configure S3 to send event notifications directly to a new SQS queue.
• Option 2 — Via SNS & SQS (S3 → SNS → SQS): Subscribe a new SQS queue to an existing SNS topic that already receives S3 events.

Both approaches share the same SQS queue, IAM policy, and IAM user setup. Follow the relevant section below based on your setup.

---

Option 1: Via SQS (S3 → SQS)

Use this approach if your S3 bucket does not already have an SNS topic configured for event notifications.

Step 1: Create SQS Queue

1. Go to SQS > Queues
2. Click Create Queue
3. Choose a queue name based on the bucket purpose

Name (examples): rlm-s3-cloudtrail, rlm-s3-alb

4. Click Create Queue
5. Copy the ARN of the queue — you will need it in the steps below

Step 2: Create IAM Policy

1. Go to IAM > Policies
2. Click Create Policy
3. Click JSON and replace the contents with the following, substituting <s3_bucket_arn> with your S3 bucket ARN and <sqs_queue_arn> with the SQS queue ARN from Step 1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "s3ReadObjects",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "<s3_bucket_arn>",
                "<s3_bucket_arn>/*"
            ]
        },
        {
            "Sid": "sqsEventNotifications",
            "Effect": "Allow",
            "Action": [
                "sqs:ChangeMessageVisibility",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes",
                "sqs:GetQueueUrl",
                "sqs:ReceiveMessage",
            ],
            "Resource": [
                "<sqs_queue_arn>"
            ]
        }
    ]
}

4. Click Next
5. Choose a policy name based on the bucket purpose

Name (examples): rlm-s3-notify-cloudtrail, rlm-s3-notify-albDescription: Grant read access to S3 bucket and permission to receive S3 notifications from the SQS queue.

6. Click Create Policy

Step 3: Create IAM User

1. Go to IAM > Users and click Create User
2. Choose a username based on the bucket purpose

Name (examples): rlm-s3-cloudtrail, rlm-s3-alb

3. Click Next
4. Select Attach policies directly
5. Search for and select the policy created in Step 2
6. Click Next, then Create user
7. Open the user that was just created and copy its ARN — you will need it in Step 4
8. Go to Security credentials and click Create access key
9. Select Third-party service, check the confirmation checkbox, then click Next
10. Enter a description:

Credentials for Realm.Security to read logs from S3 bucket

11. Click Create access key
12. Copy and save the Access Key and Secret access key — you will need these when configuring the S3 input feed in Realm

Step 4: Update SQS Access Policy

The SQS queue policy must allow S3 to publish notifications to the queue and allow the IAM user to read from it.

1. Go to SQS > Queues
2. Select the SQS queue you created
3. Go to Queue policies and click Edit
4. Replace the policy JSON with the following, substituting <sqs_queue_arn> with the SQS queue ARN and <iam_user_arn> with the IAM user ARN from Step 3

{
  "Version": "2012-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "AllowS3Publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "<sqs_queue_arn>"
    },
    {
      "Sid": "AllowRealmUser",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<iam_user_arn>"
      },
      "Action": [
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "<sqs_queue_arn>"
    }
  ]
}

5. Click Save

Step 5: Configure S3 Event Notifications

1. Go to S3 > Buckets and select your bucket
2. Go to Properties > Event notifications
3. Click Create event notification
4. Fill out the details:

Event name: RlmCreateEvents
Check All object create events
Destination: SQS Queue
Select the queue you created from the dropdown

5. Click Save changes

---

Option 2: Via SNS → SQS

Use this approach to subscribe a new SQS queue to an SNS topic that receives S3 ObjectCreate notifications, then connect that queue to Realm.

Step 1: Create and Configure SNS Topic

Skip this step if you already have an SNS topic configured to receive S3 ObjectCreate notifications. Copy its ARN and proceed to Step 2.

Create the SNS topic:

1. Go to SNS > Topics
2. Click Create topic
3. Select Standard as the type
4. Choose a topic name based on the bucket purpose

Name (examples): rlm-s3-notify-cloudtrail, rlm-s3-notify-alb

5. Click Create topic
6. Copy the ARN of the topic — you will need it in the steps below

Update the SNS topic access policy:

The SNS topic policy must allow S3 to publish to it.

1. On the topic details page, go to Access policy and click Edit
2. Replace the policy JSON with the following, substituting <sns_topic_arn> with the SNS topic ARN and <s3_bucket_arn> with your S3 bucket ARN

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3Publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sns:Publish",
      "Resource": "<sns_topic_arn>",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "<s3_bucket_arn>"
        }
      }
    }
  ]
}

3. Click Save changes

Configure S3 to send ObjectCreate notifications to the SNS topic:

1. Go to S3 > Buckets and select your bucket
2. Go to Properties > Event notifications
3. Click Create event notification
4. Fill out the details:

Event name: RlmS3ToSnsEvents
Check All object create events
Destination: SNS Topic
Select the SNS topic you created from the dropdown

5. Click Save changes

Step 2: Create SQS Queue

Follow the same steps as Step 1 in Option 1 above to create a queue and copy its ARN.

Step 3: Create IAM Policy

Follow the same steps as Step 2 in Option 1 above to create a policy and copy its ARN.

Step 4: Create IAM User

Follow the same steps as Step 3 in Option 1 above. Save the IAM user ARN, Access Key, and Secret access key.

Step 5: Update SQS Access Policy

The SQS queue policy must allow the SNS topic to publish messages to the queue and allow the IAM user to read from it.

1. Go to SQS > Queues
2. Select the queue you created
3. Go to Queue policies and click Edit
4. Replace the policy JSON with the following, substituting <sqs_queue_arn> with the SQS queue ARN, <sns_topic_arn> with the SNS topic ARN from Step 1, and <iam_user_arn> with the IAM user ARN from Step 4

{
  "Version": "2012-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "AllowSNSPublish",
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "<sqs_queue_arn>",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "<sns_topic_arn>"
        }
      }
    },
    {
      "Sid": "AllowRealmUser",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<iam_user_arn>"
      },
      "Action": [
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "<sqs_queue_arn>"
    }
  ]
}

5. Click Save

Step 6: Subscribe SQS Queue to SNS Topic

1. Go to SNS > Topics
2. Select the SNS topic from Step 1
3. Click Create subscription
4. Fill out the details:

Protocol: Amazon SQS
Endpoint: <sqs_queue_arn>

5. Click Create subscription

The subscription will be automatically confirmed since both resources are in the same AWS account.

Step 7: Verify the S3 → SNS → SQS Pipeline

• Navigate to S3 and open the bucket tied to your SNS topic.
• Go to Properties → Event notifications and confirm the existing notification is pointing to your SNS topic for s3:ObjectCreated:* events.
• Upload a test object to the S3 bucket.
• Go back to your SQS queue and click Send and receive messages.
• Click Poll for messages — you should see a message appear containing the S3 event payload.

Configure Cloud Funnel 2.0 in SentinelOne

1. Log in to your SentinelOne console as an administrator.
2. Navigate to Settings > Integrations > Cloud Funnel.
3. Click Connect and select AWS S3 as the cloud provider.
4. Enter the following:

   Bucket Name: <your S3 bucket name>
   AWS Region: <your S3 bucket region>

5. Enable Telemetry Streaming and optionally configure query filters to limit which agents stream data.
6. Under Fields to include, select All fields.
7. Click Validate, then Save.

Note: SentinelOne will begin streaming Deep Visibility telemetry to your S3 bucket. Events are written as newline-delimited JSON files organized by account, date, and event type.

Create a Source and Input Feed

1. In Realm, go to Sources > Add Source.

2. Enter a name for your source and select SentinelOne Deep Visibility as the product type.

3. Add a new Input Feed to the source and select AWS S3 as the input feed type.

4. Enter the following before saving:

   AWS Access Key ID: The access key ID from the IAM user you created.
   AWS Secret Access Key: The secret access key from the IAM user you created.
   SQS Queue URL: The URL of the SQS queue you created.