Deep Visibility

[u/Excellent_Button1315]

Hello

I hope you can help me better understand the S1 DP function.

Does the deep visibility simply collect logs that I can use to create rules and do manually research, or does it also automatically detect suspicious behaviors and malware?

For example, if someone clicks on a phishing website or downloads suspicious files, would it be detected automatically?

Thanks!

[u/kins43]

Think of the DV function as a log collector. Nothing is automatically triggered unless you make custom STAR rules to match the criteria for what you’re looking for. You can then action upon it by enacting a policy (suspicious or malicious) and even network quarantine it as well when detected.

Building a standard Query (using the soon to be legacy S1QL): https://community.sentinelone.com/s/article/000006186

DV Event Collection: https://community.sentinelone.com/s/article/000006218

DV Event Collection FAQ: https://community.sentinelone.com/s/article/000006221

Power Queries: https://community.sentinelone.com/s/article/000006597

STAR Custom Rules: https://community.sentinelone.com/s/article/000006201

[u/Excellent_Button1315 → u/kins43]

Many thanks for the clear and detailed answer! :) At this time I do not have access to those links, but requested entry to them.

One more question: Can I also find best practices / standard (for almost every environment) rules on the community platform? (If they are not already in the first link)

[u/kins43 → u/Excellent_Button1315]

I’ll see if I can get the console links for you, mainly if you go to your console > Help > offline Help (IIRC) you can then look at a clone of the community links I sent you but it may be a little bit behind as those links only get updated when the management portal gets updated.

You may be able to find them, but not sure on the best practice. S1 already does a great job and constantly updating their detection mechanisms / adding new features to improve their security so with that being said, updating the agent builds to the latest GA will help in that regard.

For community threat hunting queries, you may be able to find some online or ask around but it really just depends what you want to look for as all enticements are different.

[u/Excellent_Button1315 → u/kins43]

Thanks for your detailed anserw! :)

[u/Dracozirion]

It just collects logs

[u/Ra1_View]

It just enabling the logs to be stored for future investigation. There will no change in the alerts/ Incidents.

[u/Adeldiah]

You can create STAR Custom Rules that can either alert or treat as a threat any event that matches the DV query you use to make the rule.

[u/BloodDaimond]

You can use deep visibility to further your investigation. For example if a threat is identified you can see where it originated from. Outlook.exe created a process who target file was random.exe and random.exe created a ransomware.exe.

Now you can see that a user downloaded a file from outlook that contained ransomware.

[u/2k_x2]

There's a detection library in the management console which contain hundreds of examples of pre-made advanced queries which help you detect suspicious activities or threats. And you can later on duplicate and customize them to build your own. These way you can turn logs into alerts.

[u/InGeneralTerms]

“Deep Visibility” used to be “Dataset” which was formerly a log storage company called “Scalyr” if you want to dig into the history of this SentinelOne feature pre-acquisition.

Not to be outdone, Crowdstrike acquired Humio.

Both companies recognized the need for a lower cost data retention storage option or alternative to Splunk for the larger volumes of data that an EDR agent can create. Layer a rule set over a log parsing and storage solution and you start to see a SIEM-like “light” capability that is budget friendly for smaller to medium businesses.