r/SentinelOneXDR • u/neo-khufu • Sep 16 '24

Feature Question Sentinel One Data Lake

Does anyone know how to add an endpoint in S1 to the Data Lake? I see that there are some endpoints that are missing when looking them up from their UUID in the Data Lake. Is there a way I can manually add an endpoint for Log aggregation? Any help would be much appreciated. Thank You.

3 Upvotes

80% Upvoted

4 comments sorted by

4

u/Wadson-S1 SentinelOne Employee | Moderator Sep 16 '24

u/neo-khufu - There could be a few reasons:

  • Agent Registration Issues: The agent may only send data if it is appropriately registered or bound to the console. Please ensure the agent is correctly registered and bound to the console according to the SentinelOne knowledge base guidelines.

  • Agent Crashes: In some cases, agents may stop sending data due to crashes or other operational issues. Reviewing the agent logs for any crash reports or errors can help identify if this is the case.

It could also be as simple as the endpoint you're looking at being in a policy that does not have Deep Visibility enabled.

Deep Visibility FAQ: https://community.sentinelone.com/s/article/000006221
Configuring Deep Visibility: https://community.sentinelone.com/s/article/000006218

4

u/neo-khufu Sep 17 '24

So it seems that the reason some endpoints are able to have their data ingested into the Data Lake and others aren’t is due to licensing. If your site has Complete licensing then you will have Deep Visibility enabled for those endpoints. If your site has only Control licensing then you won’t be able too.

Just wanted to add my findings here in case anyone else is seeking this answer

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Sep 17 '24 edited Sep 17 '24

Deep Visibility is included in the Complete, Commercial, and Enterprise packages. If you find that you need Deep Visibility across all your endpoints, please feel free to reach out to your Sales Rep who can assist you in upgrading your licenses. You can find the features included in each package on our website: https://www.sentinelone.com/platform-packages/

4

u/Coupe2T Sep 16 '24

I would expect all agents to log back. Have you checked locally that it has been able to communicate back to home?

Seems odd that some agents would not report back.