In the blog titled “Streamline Endpoint Data with Cribl Pack for SentinelOne Cloud Funnel” we dove into the Cloud Funnel data, its relevance in the modern SOC, and how Cribl Stream transforms the data while addressing visibility gaps. We left the AWS-specific details to this blog for those not yet familiar with configuring AWS S3 buckets, SQS Queues, and Identity and Access Management (IAM).

We are going to use a combination of ACLs, Policies, and Roles within AWS to allow SentinelOne to write the Cloud Funnel data to your S3 bucket and to allow Cribl Stream to pull this data. We will also allow the S3 bucket to send notifications to the SQS queue to let Cribl Stream know when new data is available.

Configuring AWS SQS

After creating the S3 bucket, there are several configurations that need to occur related to event notifications and trusts. Make sure you have ACLs enabled when you create the S3 bucket because we will add an ACL in the next section to allow SentinelOne write access. I’m assuming you have created your S3 bucket and have Its associated ARN documented for reference in the below policy.

Let’s begin by using the Amazon Console to create an SQS queue. We will soon configure our S3 bucket via event notifications to send events into the SQS queue which Cribl Stream will monitor. While creating the new SQS queue in the same region as your bucket, accept all default settings except for the Access Policy section. We need to allow our S3 bucket to send notifications into this queue. Under ‘Access Policy’, set the method to ‘Advanced’ and place the below JSON blob in the text box making sure to replace the green text with values specific to your configuration. This policy states that your S3 bucket is allowed access to this queue. Save Changes.

{

“Version”: “2012-10-17”,

“Id”: “example-ID”,

“Statement”: [

{

“Effect”: “Allow”,

“Principal”: {“Service”: “s3.amazonaws.com”},

“Action”: “SQS:SendMessage”,

“Resource”: “arn:aws:sqs:us-east-1:999999999999:CFQueue-sentinelone-cloudfunnel-v2”,

“Condition”: {“StringEquals”: {“aws:SourceAccount”: “999999999999”},

“ArnLike”: {“aws:SourceArn”: “arn:aws:s3:::your-cloudfunnel-xdr-inbound-bucket”}

}

}

]

}

We need to configure your S3 bucket to send event notifications into your new SQS queue. Select your bucket, select the ‘Properties’ tab, and scroll down to ‘Event Notifications’. Create a new Event Notification, select ‘All Object Create Events’ under ‘Object Creation’, set the Destination to ‘SQS Queue’, and enter your SQS queue ARN. Save changes.

Configure S3 Permissions

We need to allow Cloud Funnel to write to your new S3 bucket. From within the AWS S3 console select your bucket then select the ‘Permissions’ tab. SentinelOne provides clear instructions which included a canonical ID which is used to create an ACL to provide access. Under ‘Access Control List’, select ‘Edit’ then populate the ‘Access for other AWS accounts’ section with the Grantee Canonical ID and select Objects ‘List’ and ‘Write’. Save Changes.

Before we create and configure a new Cribl Stream Source we need to make sure we have AWS IAM policies and a role allowing Cribl Stream to read from our new S3 bucket via the SQS Queue. Cribl Stream will assume this new role. From your AWS IAM console, select ‘Policies’ on the left then ‘Create Policy’ to create a policy providing access to the S3 bucket. Select the ‘JSON’ tab and place the below JSON blob in the text box making sure to replace the green text with values specific to your configuration. Save Changes.

{

“Version”: “2012-10-17”,

“Statement”: [

{

“Effect”: “Allow”,

“Action”: [“s3:GetObject”,”s3:ListBucket”,”s3:GetBucketLocation”],

“Resource”: [“arn:aws:s3::: arn:aws:s3:::your-cloudfunnel-xdr-inbound-bucket “,

“arn:aws:s3::: arn:aws:s3:::your-cloudfunnel-xdr-inbound-bucket /*”]

}

]

}

We need to repeat the above for a second policy that provides access to the SQS Queue.

{

“Version”: “2012-10-17”,

“Statement”: [

{

“Effect”: “Allow”,

“Action”: [

“sqs:DeleteMessage”,

“sqs:GetQueueUrl”,

“sqs:ChangeMessageVisibility”,

“sqs:ReceiveMessage”,

“sqs:GetQueueAttributes”],

“Resource”: “arn:aws:sqs:us-east-1:999999999999:your-cloudfunnel-xdr-SQS”

}

]

}

We need an AWS IAM role containing these two policies which Cribl Stream will assume. Before configuring our new AWS IAM role, we need to grab our Cribl Stream Worker ARNs. We do this by returning to our Cribl.Cloud home screen, select ‘Network Settings’ from the top, select ‘Trust’, then copy our Worker ARN as seen below.

From your AWS IAM console, select ‘Roles’ on the left then ‘Create Role’. Set the Trusted Entity Type to ‘Custom Trust Policy’ and place the below JSON blob in the text box making sure to replace the green text with values specific to your Worker ARNs. The External ID is optional but check this out for a bit of an explanation as well as a deeper dive into AWS Trusts and Cribl Stream.

{

“Version”: “2012-10-17”,

“Statement”: [

{

“Sid”: “Statement1”,

“Effect”: “Allow”,

“Principal”: {“AWS”: “arn:aws:iam::<your-worker-account>:role/main-default”},

“Action”: “sts:AssumeRole”,

“Condition”: {“StringEquals”: {“sts:ExternalId”: “Pu1pF1ct10n”}}

}

]

}

Click the ‘Next’ button to add permissions. Select the two policies you created above from the list and click ‘Next’. Provide a Role name and description then click the ‘Create Role’ button. You will refer to this Role ARN from within the Cribl Stream tile when configuring the ‘Assume Role’ field.

You should now be able to configure the Cloud Funnel Integration within the SentinelOne Singularity console and verify that data is being written to the S3 bucket. You should also be able to configure Cribl Stream to pull the Cloud Funnel data from the S3 bucket and use the Cribl Pack for SentinelOne Cloud Funnel to transform, enrich, and route to one or more destinations.

The fastest way to get started with Cribl Stream, Edge, and Search is to try the Free Cloud Sandboxes.