The failure on screen is:
Traceback (most recent call last): File "/app/Backend/event_generators/shared/hec_sender.py", line 1602, in <module> results = send_many_with_spacing( ^^^^^^^^^^^^^^^^^^^^^^^ File "/app/Backend/event_generators/shared/hec_sender.py", line 1269, in send_many_with_spacing results.append(send_one(line, product, attr_fields)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/Backend/event_generators/shared/hec_sender.py", line 1256, in send_one raise last_error File "/app/Backend/event_generators/shared/hec_sender.py", line 1234, in send_one resp.raise_for_status() File "/usr/local/lib/python3.11/site-packages/requests/models.py", line 1026, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 405 Client Error: METHOD NOT ALLOWED for url: https://ingest.sentinelone.net/services/collector/event ERROR: HEC send failed with code 1 INFO: Log generation complete.
This is because the API call to SentinelOne AI SIEM must include a header S1-Scope.
I suggest to include this modification:
# ⬇️ MODIFICATION START ⬇️
# Retrieve the S1_SCOPE_ID environment variable
S1_SCOPE_ID = os.getenv("S1_SCOPE_ID")
# Add the S1-Scope header if the environment variable is set
if S1_SCOPE_ID:
HEADERS["S1-Scope"] = S1_SCOPE_ID
# ⬆️ MODIFICATION END ⬆️
hec_sender-with-scopeid.py
The failure on screen is:
Traceback (most recent call last): File "/app/Backend/event_generators/shared/hec_sender.py", line 1602, in <module> results = send_many_with_spacing( ^^^^^^^^^^^^^^^^^^^^^^^ File "/app/Backend/event_generators/shared/hec_sender.py", line 1269, in send_many_with_spacing results.append(send_one(line, product, attr_fields)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/Backend/event_generators/shared/hec_sender.py", line 1256, in send_one raise last_error File "/app/Backend/event_generators/shared/hec_sender.py", line 1234, in send_one resp.raise_for_status() File "/usr/local/lib/python3.11/site-packages/requests/models.py", line 1026, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 405 Client Error: METHOD NOT ALLOWED for url: https://ingest.sentinelone.net/services/collector/event ERROR: HEC send failed with code 1 INFO: Log generation complete.This is because the API call to SentinelOne AI SIEM must include a header
S1-Scope.I suggest to include this modification:
hec_sender-with-scopeid.py