SentinelOne Deep Visibility Integration

Send SentinelOne Deep Visibility Events to Realm

This guide walks you through connecting SentinelOne Deep Visibility events to Realm. The integration uses Cloud Funnel 2.0 — SentinelOne streams telemetry data directly to a customer-owned AWS S3 bucket, which Realm polls to retrieve endpoint events and forward them through your data pipeline to your configured destination.

Prerequisites

• A SentinelOne account with administrator access
• Access to the AWS Console with permissions to create S3 buckets and SQS queues
• Access to the Realm Security console

Create an S3 Bucket

Cloud Funnel 2.0 requires a customer-owned S3 bucket to stream telemetry into.

1. Go to the AWS Console and navigate to S3.
2. Click Create bucket.
3. Enter a globally unique bucket name (e.g., my-org-sentinelone-cloudfunnel) and select your preferred region.
4. Leave all other settings at their defaults and click Create bucket.

Note: Take note of the bucket name and region — you will need both when configuring Cloud Funnel in SentinelOne.

Create an SQS Queue

Realm uses an SQS queue to receive S3 event notifications when new telemetry files are written to the bucket.

1. In the AWS Console, navigate to SQS.
2. Click Create queue, select Standard, and enter a name (e.g., sentinelone-cloudfunnel-notify).
3. Under Access policy, grant the S3 bucket permission to send messages to the queue. Replace <queue-arn> and <bucket-arn> with your values:

{
  "Version": "2012-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "AllowS3Publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "<sqs_queue_arn>"
    },
    {
      "Sid": "AllowRealmUser",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<iam_user_arn>"
      },
      "Action": [
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "<sqs_queue_arn>"
    }
  ]
}

4. Click Create queue and copy the Queue URL — you will need this when configuring the input feed in Realm.

Configure S3 Event Notifications

1. In the AWS Console, navigate back to your S3 bucket.
2. Click the Properties tab and scroll to Event notifications.
3. Click Create event notification.
4. Under Event types, select All object create events.
5. Under Destination, select SQS queue and choose the queue you created.
6. Click Save changes.

Create an IAM Policy and User for Realm

Realm needs read access to your S3 bucket and SQS queue.

1. In the AWS Console, navigate to IAM > Policies and click Create policy.
2. Use the following JSON, replacing <bucket-name> and <queue-arn> with your values:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "s3ReadObjects",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "<s3_bucket_arn>",
                "<s3_bucket_arn>/*"
            ]
        },
        {
            "Sid": "sqsEventNotifications",
            "Effect": "Allow",
            "Action": [
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage"
            ],
            "Resource": [
                "<sqs_queue_arn>"
            ]
        }
    ]
}

3. Name the policy (e.g., RealmSentinelOneCloudFunnel) and click Create policy.
4. Navigate to IAM > Users, click Create user, and attach the policy you just created.
5. Under the new user's Security credentials tab, click Create access key and select Third-party service.
6. Copy the Access Key ID and Secret Access Key — you will need these when configuring the input feed in Realm.

Configure Cloud Funnel 2.0 in SentinelOne

1. Log in to your SentinelOne console as an administrator.
2. Navigate to Settings > Integrations > Cloud Funnel.
3. Click Connect and select AWS S3 as the cloud provider.
4. Enter the following:

   Bucket Name: <your S3 bucket name>
   AWS Region: <your S3 bucket region>

5. Enable Telemetry Streaming and optionally configure query filters to limit which agents stream data.
6. Under Fields to include, select All fields.
7. Click Validate, then Save.

Note: SentinelOne will begin streaming Deep Visibility telemetry to your S3 bucket. Events are written as newline-delimited JSON files organized by account, date, and event type.

Create a Source and Input Feed

1. In Realm, go to Sources > Add Source.

2. Enter a name for your source and select SentinelOne Deep Visibility as the product type.

3. Add a new Input Feed to the source and select AWS S3 as the input feed type.

4. Enter the following before saving:

   AWS Access Key ID: The access key ID from the IAM user you created.
   AWS Secret Access Key: The secret access key from the IAM user you created.
   SQS Queue URL: The URL of the SQS queue you created.