[sentinel_one] Add Support for Application Risk Data Stream #14910

mohitjha-elastic · 2025-08-12T11:41:50Z

Proposed commit message

sentinel_one: Add support for application risk data stream and ilm policy to application data stream.

Added support for ingesting data through the SentinelOne application risk data stream.
This includes necessary configuration updates and input adjustments to enable collection and parsing of
application risk–related events, ensuring accurate ingestion and processing of risk insights
from supported sources.
Also added ilm policy to the application data stream.

Tested on the live samples collected through the SentinelOne API.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/sentinel_one directory.
Run the following command to run tests.

elastic-package test -v

Related Issue

Related to enhancement issue 25330

elasticmachine · 2025-08-12T11:41:54Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

elastic-vault-github-plugin-prod · 2025-08-13T08:17:57Z

🚀 Benchmarks report

Package `sentinel_one` 👍(14) 💚(0) 💔(0)

Expand to view

Data stream	New EPS	Diff (%)	Result
`alert`	3703.7	3703.7 ( - %)	👍
`application`	9174.31	9174.31 ( - %)	👍
`application_risk`	5586.59	5586.59 ( - %)	👍
`group`	25000	25000 ( - %)	👍
`threat`	2178.65	2178.65 ( - %)	👍
`activity`	5200.21	5200.21 ( - %)	👍
`agent`	3753.75	3753.75 ( - %)	👍
`alert`	3361.34	3361.34 ( - %)	👍
`application`	21321.96	21321.96 ( - %)	👍
`application_risk`	9066.18	9066.18 ( - %)	👍
`group`	34246.58	34246.58 ( - %)	👍
`threat`	1719.39	1719.39 ( - %)	👍
`activity`	5291.01	5291.01 ( - %)	👍
`agent`	4484.3	4484.3 ( - %)	👍

packages/sentinel_one/_dev/build/docs/README.md

kcreddy · 2025-08-19T07:27:09Z

packages/sentinel_one/data_stream/application_risk/elasticsearch/ilm/default_policy.json

@@ -0,0 +1,20 @@
+{


For this ILM policy to work, you would need delete_index privilege on source indices for kibana_system role.

https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java#L438-L439

Thanks!
Here is the PR - elastic/elasticsearch#133793

(Added the application_risk under CDR packages list that ships a transform and has ILM policy)

..._one/data_stream/application_risk/_dev/test/pipeline/test-application-risk.log-expected.json

packages/sentinel_one/data_stream/application_risk/elasticsearch/ingest_pipeline/default.yml

packages/sentinel_one/elasticsearch/transform/latest_risk/transform.yml

1. Remove tranform pipeline. 2. Add some ECS mappings in the pipeline. 3. Update event.kind to state from event.

kcreddy

LGTM, but will approve and merge after permissions are merged and backported. #14910 (comment)

mohitjha-elastic · 2025-09-04T10:28:47Z

LGTM, but will approve and merge after permissions are merged and backported. #14910 (comment)

@kcreddy
ILM Permissions have been updated and PR related to that has been merged.
Can you please merge this if everything looks good now?

kcreddy

@kcreddy ILM Permissions have been updated and PR related to that has been merged. Can you please merge this if everything looks good now?

You will need to change kibana.version to ^8.18.7 || ^8.19.4 || ^9.0.7 || ^9.1.4 and can merge it only after they are public (not released yet).

kcreddy

@mohitjha-elastic , can you also add policy tests for this new data stream?
Please check #15029

For the benchmarks, please ensure to add them in this PR or as part of #14741.

There is also future data stream (Threat Events) that should be handled similarly.

cc: @navnit-elastic

…sentinel_one-1.38.0

mohitjha-elastic · 2025-09-18T11:06:07Z

@kcreddy
New versions are out and also added the pipeline and rally benchmark as a part of #14741

System benchmark is blocked. Ref here.

kcreddy

@mohitjha-elastic, Can you please fix CI issue of naming benchmark files?

kcreddy · 2025-09-18T16:04:20Z

/test benchmark fullreport

elasticmachine · 2025-09-18T16:40:16Z

💚 Build Succeeded

Buildkite Build
Commit: 0812b66

History

💚 Build #31652 succeeded 0812b66
💔 Build #31643 failed f8d149a
💚 Build #30823 succeeded eb98f51
💚 Build #30602 succeeded f47b531
💚 Build #29963 succeeded f1115b1
💔 Build #29936 failed 6772b03

cc @mohitjha-elastic

elastic-sonarqube · 2025-09-18T16:40:23Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
94.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

kcreddy

Thanks!

elastic-vault-github-plugin-prod · 2025-09-19T06:03:07Z

Package sentinel_one - 1.38.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/1.38.0/

Add application risk data stream

c8b819e

mohitjha-elastic self-assigned this Aug 12, 2025

mohitjha-elastic requested a review from a team as a code owner August 12, 2025 11:41

Update changelog entry

6772b03

andrewkroh added dashboard Relates to a Kibana dashboard bug, enhancement, or modification. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Aug 12, 2025

Add more test logs to improve code coverage

f1115b1

kcreddy reviewed Aug 19, 2025

View reviewed changes

mohitjha-elastic mentioned this pull request Aug 29, 2025

[Sentinel One] - Fix Cannot execute ILM policy delete step elastic/elasticsearch#133793

Merged

Resolve review comments.

f47b531

1. Remove tranform pipeline. 2. Add some ECS mappings in the pipeline. 3. Update event.kind to state from event.

mohitjha-elastic requested a review from kcreddy August 29, 2025 09:13

kcreddy reviewed Aug 29, 2025

View reviewed changes

Add ILM Policy to the data streams

10b8c98

kcreddy reviewed Sep 4, 2025

View reviewed changes

Update the kibana version in manifest

eb98f51

kcreddy reviewed Sep 10, 2025

View reviewed changes

mohitjha-elastic added 2 commits September 16, 2025 19:18

Merge branch 'main' of github.com:mohitjha-elastic/integrations into …

1287853

…sentinel_one-1.38.0

Add pipeline and rally benchmarks

f8d149a

mohitjha-elastic requested a review from kcreddy September 18, 2025 11:06

kcreddy reviewed Sep 18, 2025

View reviewed changes

Add policy test and resolve CI issue.

0812b66

mohitjha-elastic requested a review from kcreddy September 18, 2025 13:52

kcreddy approved these changes Sep 18, 2025

View reviewed changes

mohitjha-elastic merged commit 60ac006 into elastic:main Sep 19, 2025
9 checks passed

mohitjha-elastic deleted the sentinel_one-1.38.0 branch September 19, 2025 05:45

[sentinel_one] Add Support for Application Risk Data Stream #14910

[sentinel_one] Add Support for Application Risk Data Stream #14910

Conversation

mohitjha-elastic commented Aug 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related Issue

Uh oh!

elasticmachine commented Aug 12, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Package sentinel_one 👍(14) 💚(0) 💔(0)

Uh oh!

Uh oh!

kcreddy Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

mohitjha-elastic Aug 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

mohitjha-elastic commented Sep 4, 2025

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

kcreddy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mohitjha-elastic commented Sep 18, 2025

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

kcreddy commented Sep 18, 2025

Uh oh!

elasticmachine commented Sep 18, 2025

💚 Build Succeeded

History

Uh oh!

elastic-sonarqube bot commented Sep 18, 2025

Quality Gate passed

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 19, 2025

Uh oh!

Uh oh!

mohitjha-elastic commented Aug 12, 2025 •

edited

Loading

elastic-vault-github-plugin-prod bot commented Aug 13, 2025 •

edited

Loading

Package `sentinel_one` 👍(14) 💚(0) 💔(0)

mohitjha-elastic Aug 29, 2025 •

edited

Loading

kcreddy left a comment •

edited

Loading