fix(sentinel-one): parse CEF header and full values; align rule consumers

[kryonsx]

Summary

The SentinelOne filter did not parse the management-console CEF records seen in the field, so none of the 19 SentinelOne rules could match a real record. This draft fixes the parser and updates 14 rules so they read what the filter now produces, without firing on ordinary console administration.

Predecessor: #2595 (closed, historical context only).

Filter (filters/antivirus/sentinel-one.yml, 3.0.0 → 3.0.1)

• Parse the CEF header by position, anchored on CEF:. The event name now reaches log.eventDescription. The header severity is kept as vendor detail in log.cefSeverity; standard severity is not set.
• Remove the two header parsers that took log.syslogHost from the product-version slot. Real records carry a console build string there.
• Guard kv so lines without a CEF extension no longer produce a large parser error.
• Keep multi-word values whole (site, account, user, group and address keys), including when the key is last. Header text no longer becomes junk field names.
• Extract the full rt time to log.ruleTime and convert it to deviceTime.
• Copy the console actor (suser) to origin.user for console events (cat=SystemEvent).
• The actionResult block is unchanged. A separate draft revises it.

Rules (rules/antivirus/sentinel-one/, 14 files)

• Replace the log.syslogHost gate and grouping with target.host. This ships together with the parser removal above.
• memory_injection_detection: remove a branch that read log.eventDescToParse, which the filter deletes.
• s1_policy_downgrade: require the Protect-to-Detect direction; it no longer fires on upgrades.
• Whole-word matching in the tampering, mitigation-failure and IoT rules. For example, "ics" no longer matches inside "analytics".
• kernel_level_threat and the "reputation" branch of threat_intelligence_matches now require target.host, so console admin text cannot fire them.
• The exclusion and policy rules now group by adversary.user.
• threat_intelligence_matches: use the vendor-documented confidence value MALICIOUS instead of >= 90.
• Names, IDs, thresholds, windows, impact, adversary and MITRE labels are unchanged.

Validation

• Full plugins/alerts Go suite passes, linked go-sdk v1.1.33. Five new SentinelOne tests are included, and four of them fail against the original files.
• plugins/alerts/testdata/sentinel-one/replay.py runs 52 fabricated raw lines through an isolated EventProcessor playground (commit 497bf53). With the corrected filter and rules there were zero parser errors, and each intended local alert fired exactly once.
• Genuine console records (user added, user deleted, role assigned) were replayed privately. With the corrected filter and rules, none of the 19 rules alerted on them. With the corrected filter and the original rules, 7 rules produced false alarms, so the filter and rules must ship together.

Limits

• SentinelOne's syslog/CEF reference was not readable from public vendor sources. Threat-event extension keys, the activity-code list and the CEF severity scale are therefore not established.
• Seven rules now depend on target.host. Nothing writes it until the endpoint key is documented, and before this change those rules depended on a field that real records never had.
• Deferred and listed in the audit:
  • activity-code lists, duser → target.user, severity/action mapping, IoT/Storyline rule relevance;
  • MITRE relabelling (T1562 was revoked in ATT&CK v19).
• Two known false-alarm patterns remain until activity codes are documented. They are listed in the audit.
• Playground parser plugins link go-sdk v1.1.26 and the rule plugin links v1.1.34, while this module pins v1.1.33. History searches, grouping, deduplication, production alerts and notifications were not tested. No SentinelOne threat records were available.
• A parallel draft edits the same filter's actionResult block. The only expected conflict is the version comment line.

See filters/audits/sentinel-one.md for details.

🤖 Generated with Claude Code