Bidirectional integration response actions (SentinelOne)

[joepeeples]

Description

Create docs and docs links for bi-directional integration response actions, per https://github.com/elastic/security-team/issues/7780#issuecomment-1828209705.

Response action configuration

From #4534, which we closed in favor of this meta-ish issue.

First release of our bidirectional integration work - https://github.com/elastic/security-team/issues/6200

There are a handful of steps users must take to ensure they are able to successfully take action on Sentinel One hosts (for the initial tech preview release in 8.12, the only action is to isolate / release a host). We want to make sure we have a page that walks through the full configuration requirements.

Prerequesites:

• Should have active running S1 agents

High level steps:

1. Ensure there is an agent policy created (Fleet) that will be responsible for pulling S1 data)
2. Add and configure the Sentinel One integration to policy
3. Create a security detection rule to get elastic alerts for Sentinel One alerts
   • logs-sentinel_one.alert*
4. Create a connector for Sentinel One
   • Needed for manual response actions; automated actions not available yet
   • Create ONLY one connector
   • API token needs to have privileges to perform actions (isolate/release host)

Information needed

• Which documentation set does this change impact? (ESS, serverless, or both) — Both
• Feature differences (ESS vs. serverless) — n/a
• ESS release — 8.12.0
• Serverless release — January 16, 2024 (coordinated with ESS release)
• API docs impact — ???
• License/subscription/tier required:
  • ESS — Enterprise
  • Serverless — Endpoint Protection Complete
• RBAC required:
  • ESS permissions/roles — all permissions for connectors & actions (may change in future releases)
  • Serverless preset roles — SOC manager, Endpoint operations analyst (per security-team#7911)
• Feature flags needed to enable feature — ESS available as of 8.12 BC5. Serverless flags enabled to hide in serverless until ESS release.

---

Pull requests, related tasks

Tasks

Preview Give feedback

1. Create stub page for docs link: configure response actions (Classic) — Create stub page for bi-directional integration response actions (SentinelOne)  #4317
2. Create main docs (Classic) — Bidirectional integration response actions (SentinelOne) — Classic docs #4593
3. Update S1 integration docs — [Security Solution] Update SentinelOne integration README with info. on configuring response actions integrations#8611. 🚫 Will also 404 until 8.12 is published, due to cross-docs link.
4. Serverless: Create main docs — https://github.com/elastic/staging-serverless-security-docs/pull/271
5. Connector docs (Classic) — Add docs for SentinelOne connector kibana#174696 (also affects connector API docs)
6. Serverless: Connector docs — Update serverless connectors page: https://github.com/elastic/staging-serverless-general-docs/pull/160). 🚫 Cross-docs link will 404 until Classic/ESS connector docs are published for 8.12
7. Classic docs: Update link to connector docs page — Update link to SentinelOne connector docs in classic #4745
8. Serverless docs: Update link to connector docs page — https://github.com/elastic/staging-serverless-security-docs/pull/285

Order of operations

Cross-docs links create some dependencies between the PRs above. Merge in the following order to minimize breaking builds. Note that we'll need to update links in some PRs before merging them.

1. Connector docs
2. Main docs — Update link to connector docs
3. Integration docs — Update link to main docs (once 8.12 docs are published and current == 8.12)
4. Serverless connector docs — Confirm link from serverless landing page to classic connector page works

[joepeeples]

Features are available now (as of 8.12.0 release). OK to publish serverless as soon as content is ready.

[joepeeples]

All docs updates complete.