ASIM Alert Event Parser for SentinelOneAlerts_CL

[Karen Ivy Titiwa (aivee-tee)]

Change(s):

• Added Alert Event ASIM parser for SentinelOne Singularity Alerts

Reason for Change(s):

• Support the SentinelOne Singularity Alerts schema "SentinelOneAlerts_CL" ingested via CCF

Version Updated:

• Yes

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[v-atulyadav]

Hi Karen Ivy Titiwa (@aivee-tee),
Please review the failed validation. Thanks

[Karen Ivy Titiwa (aivee-tee)]

Hi Karen Ivy Titiwa (Karen Ivy Titiwa (@aivee-tee)), Please review the failed validation. Thanks

Good day v-atulyadav,

Validation failure shows:
Failed to resolve table or column expression named 'SentinelOneAlerts_CL'

I've noticed that the sample data being ingested is from the table SentinelOne_CL which comes from the deprecated SentinelOne data connector, I've renamed the sample data. PR for approval please.

Thank you!