Standardize Ingested Data for Response Actions

[raqueltabuyo]

Standardize Ingested Data for Response Actions

Description

To improve bidirectional response actions, we need consistent data ingestion from CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint. This includes host listings, machine action tracking, and essential identifiers.

Requirements

Ensure all three integrations provide:

• A list of hosts (following SentinelOne’s current approach).
• List of action statuses (e.g., "Machine Actions" in Microsoft Defender).
• agent.id - Some systems (e.g,. SentinelOne) have multiple “agent”/“Host” ID, the one needed to be captured is the ID that in turn is used with the external system’s API.
• host.os.type

Impact

• Inconsistent data limits the effectiveness of automated response actions.
• Without standard fields, response workflows may not work uniformly across vendors.

Next Steps

1. Identify discrepancies in host listings, action status tracking, and key identifiers across vendors.
2. Ensure proper ECS mapping and normalization for these fields.
3. Implement required transformations or enrichments to fill data gaps.
4. Prioritize Microsof Defender.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)