[sentinelone-indicator-stream] A Stream Connector allowing Indicators to be pushed to a SentinelOne Account as IOCs

[maximus-debski]

Proposed changes

• Initial Creation of the SentinelOne Indicator Stream Connector

Related issues

• NA

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

NOTE: This connector's development occurred in the 'sentinelone-indicators' pull request. This is a fresh, new pull request that contains signed commits only. See #3269

[Powlinett]

Thanks again four your contribution @maximus-debski 🙏
Except a small typo that prevent docker to launch the container the connector seems to work fine 🙌
Would you mind to remove "-stream" from the connector's name and simply call it "sentinelone-indicator" before we merge it? 😇
Thanks!

[Powlinett]

As discussed, please don't forget to update docker files according to the new connector's name.
Here service's name should be sentinelone-indicator and image's name should be opencti/sentinelone-indicator:6.5.1.

[yoan-famel]

Hi @Powlinett, sorry for the direct ping

I just noticed this came up after applying these changes to the docker-compose:

'Failed to deploy a stack: sentinelone-indicator Pulling sentinelone-indicator Error pull access denied for opencti/sentinelone-indicator, repository does not exist or may require 'docker login': denied: requested access to the resource is denied Error response from daemon: pull access denied for opencti/sentinelone-indicator, repository does not exist or may require 'docker login': denied: requested access to the resource is denied'

After browsing Docker hub I noticed the opencti/sentinelone-indicator image wasn't listed.

Do we have some recommendations or a fix in place for this implementation? Many thanks

[Powlinett]

Hi @yoan-famel,
yes the connector has never been published yet, it's done automatically once merged into master. But the image's name opencti/sentinelone-indicator is correct 👍
During development you can replace the image: opencti/sentinelone-indicator:<version> by build: . for instance, but it shouldn't be committed this way, we need the image's name for automations 😇