[sentinel_one] Add unified alert data stream by brijesh-elastic · Pull Request #17304 · elastic/integrations

brijesh-elastic · 2026-02-09T09:46:18Z

Proposed commit message

sentinel_one: Add support for unified alert data stream.

This data stream collects unified alert logs from the Singularity™ Operations Center
platform via the Unified Alert Management GraphQL API.

API documentation is available with login[1].

Test samples were derived from documentation and live data samples, 
which were subsequently sanitized.

[1] https://usea1-partners.sentinelone.net/soc-docs/en/unified-alert-management-graphql-api.html

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/sentinel_one directory.
Run the following command to run tests.

elastic-package test -v

Related Issue

github-actions · 2026-02-09T09:50:15Z

Vale Linting Results

Summary: 9 warnings, 3 suggestions found

⚠️ Warnings (9)

File	Line	Rule	Message
packages/sentinel_one/docs/README.md	2446	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/sentinel_one/docs/README.md	2449	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/sentinel_one/docs/README.md	2450	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/sentinel_one/docs/README.md	2480	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/sentinel_one/docs/README.md	2480	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/sentinel_one/docs/README.md	2550	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/sentinel_one/docs/README.md	2550	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/sentinel_one/docs/README.md	2592	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/sentinel_one/docs/README.md	2599	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (3)

File	Line	Rule	Message
packages/sentinel_one/docs/README.md	2494	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/sentinel_one/docs/README.md	2494	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/sentinel_one/docs/README.md	2571	Elastic.WordChoice	Consider using 'open' instead of 'launch', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-02-10T10:38:04Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2026-02-10T10:40:17Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy

Also consider suggestions from Vale linting results

brijesh-elastic · 2026-02-16T07:18:06Z

Also consider suggestions from Vale linting results

All the suggestions are about the description of fields in the README. So we can’t change the description of ECS fields or SentinelOne-provided fields.

kcreddy

Can you also fix some of the vale linting comments

efd6 · 2026-02-19T00:37:37Z

 ### How it works

-This integration periodically queries the SentinelOne REST API to retrieve Activity, Agent, Alert, Application, Application Risk, Group, Threat and Threat Event logs.
+This integration periodically queries the SentinelOne REST API to retrieve Activity, Agent, Alert, Application, Application Risk, Group, Threat, Threat Event and Unified Alert logs.


Oxford comma is appropriate here to disambiguate "(Threat Event) and (Unified Alert) logs" from "(Threat Event and Unified Alert) logs".

Suggested change

This integration periodically queries the SentinelOne REST API to retrieve Activity, Agent, Alert, Application, Application Risk, Group, Threat, Threat Event and Unified Alert logs.

This integration periodically queries the SentinelOne REST API to retrieve Activity, Agent, Alert, Application, Application Risk, Group, Threat, Threat Event, and Unified Alert logs.

elasticmachine · 2026-02-19T03:49:17Z

💚 Build Succeeded

Buildkite Build
Commit: 0aa5e12

History

💚 Build #38406 succeeded 8a9928c
💚 Build #38262 succeeded 939d569
💔 Build #38259 failed 5604062
💔 Build #38163 failed d5b5a53
💚 Build #37819 succeeded bf2c2d0
💔 Build #37703 failed 28a0951

cc @brijesh-elastic

elastic-vault-github-plugin-prod · 2026-02-19T08:13:47Z

Package sentinel_one - 2.4.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/2.4.0/

…alert (#142648) This PR focuses on the short term solution which add the `logs-sentinel_one.unified_alert-*` indices under the `kibana_system` role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming [PR](elastic/integrations#17304). As it ships transform pipeline too hence read, write permissions are also required.

…alert (#142823) This PR focuses on the short term solution which add the `logs-sentinel_one.unified_alert-*` indices under the `kibana_system` role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming [PR](elastic/integrations#17304). As it ships transform pipeline too hence read, write permissions are also required. (cherry picked from commit eba47dd)

…alert (#142824) This PR focuses on the short term solution which add the `logs-sentinel_one.unified_alert-*` indices under the `kibana_system` role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming [PR](elastic/integrations#17304). As it ships transform pipeline too hence read, write permissions are also required. (cherry picked from commit eba47dd)

…alert (#142822) This PR focuses on the short term solution which add the `logs-sentinel_one.unified_alert-*` indices under the `kibana_system` role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming [PR](elastic/integrations#17304). As it ships transform pipeline too hence read, write permissions are also required. (cherry picked from commit eba47dd)

This data stream collects unified alert logs from the Singularity™ Operations Center platform via the Unified Alert Management GraphQL API. API documentation is available with login[1]. Test samples were derived from documentation and live data samples, which were subsequently sanitized. [1] https://usea1-partners.sentinelone.net/soc-docs/en/unified-alert-management-graphql-api.html

Add unified alert data stream

a420862

brijesh-elastic self-assigned this Feb 9, 2026

update changelog entry

28a0951

andrewkroh added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Feb 9, 2026

resolve build failure

bf2c2d0

brijesh-elastic marked this pull request as ready for review February 10, 2026 10:40

brijesh-elastic requested a review from a team as a code owner February 10, 2026 10:40

kcreddy self-requested a review February 13, 2026 04:41

kcreddy reviewed Feb 13, 2026

View reviewed changes

brijesh-elastic added 3 commits February 13, 2026 14:38

Merge branch 'main' into sentinel_one-2.2.0

62255e6

Merge branch 'main' into sentinel_one-2.2.0

d5b5a53

address comment

5604062

brijesh-elastic added 2 commits February 16, 2026 13:18

resolve policy test failure

939d569

Merge branch 'main' into sentinel_one-2.2.0

8a9928c

brijesh-elastic requested a review from kcreddy February 18, 2026 10:23

brijesh-elastic mentioned this pull request Feb 18, 2026

[Sentinel One] Fix Cannot execute ILM policy delete step for unified alert elastic/elasticsearch#142648

Merged

kcreddy reviewed Feb 18, 2026

View reviewed changes

Comment thread packages/sentinel_one/_dev/build/docs/README.md Outdated

efd6 reviewed Feb 19, 2026

View reviewed changes

address comment on readme documentation

0aa5e12

kcreddy approved these changes Feb 19, 2026

View reviewed changes

brijesh-elastic requested a review from efd6 February 19, 2026 05:03

efd6 approved these changes Feb 19, 2026

View reviewed changes

brijesh-elastic merged commit fbe2dac into elastic:main Feb 19, 2026
11 checks passed

brijesh-elastic mentioned this pull request Mar 23, 2026

[Sentinel_one] Add ILM Policy for unified alert data stream #17964

Merged

5 tasks

Navigation Menu

Uh oh!

[sentinel_one] Add unified alert data stream - #17304

[sentinel_one] Add unified alert data stream#17304
brijesh-elastic merged 9 commits into
elastic:mainfrom
brijesh-elastic:sentinel_one-2.2.0

brijesh-elastic commented Feb 9, 2026 •

edited

Loading

github-actions Bot commented Feb 9, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Feb 10, 2026

elasticmachine commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment •

edited

Loading

brijesh-elastic commented Feb 16, 2026

kcreddy left a comment

Uh oh!

efd6 Feb 19, 2026

elasticmachine commented Feb 19, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Feb 19, 2026

Labels

5 participants

	This integration periodically queries the SentinelOne REST API to retrieve Activity, Agent, Alert, Application, Application Risk, Group, Threat, Threat Event and Unified Alert logs.
	This integration periodically queries the SentinelOne REST API to retrieve Activity, Agent, Alert, Application, Application Risk, Group, Threat, Threat Event, and Unified Alert logs.

Uh oh!

Conversation

brijesh-elastic commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related Issue

github-actions Bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

elastic-vault-github-plugin-prod Bot commented Feb 10, 2026

🚀 Benchmarks report

elasticmachine commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

brijesh-elastic commented Feb 16, 2026

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

efd6 Feb 19, 2026

Choose a reason for hiding this comment

elasticmachine commented Feb 19, 2026

💚 Build Succeeded

History

Uh oh!

elastic-vault-github-plugin-prod Bot commented Feb 19, 2026

Labels

5 participants

brijesh-elastic commented Feb 9, 2026 •

edited

Loading

github-actions Bot commented Feb 9, 2026 •

edited

Loading

kcreddy left a comment •

edited

Loading