S1 with enrichment config

The Censys for SentinelOne Singularity Operations Center integration adds the ability to:

• Automatically or manually enrich IPs, web properties, and certificates in SentinelOne with Censys Platform data.
• Initiate a Censys rescan of a host or web property.
• Retrieve scan history for an IP address.
• Initiate a CensEye automated pivoting job to find assets related to an IP, web property, or certificate.

These actions can be executed using five pre-built Hyperautomation workflows.

This guide walks through how to set up and use the Censys for SentinelOne application.

Prerequisites

• SentinelOne Singularity Operations Center version S-26.1.6.134 or a higher active GA version that supports Hyperautomation workflows and integrations.

• To configure and manage the integration in SentinelOne, you must have a SentinelOne user with the following minimum permissions.

  • View and Edit permissions for Hyperautomation.
  • Run, Stop, Export, and Delete workflow permissions.

• Your Censys Platform organization ID.

  • To obtain your organization ID:

    1. Open the Platform web console and ensure that your organization account is selected. Go to Settings > Account Management > Personal Access Tokens.

    2. The ID for your organization is shown in the "Current Organization" box. Click Copy to copy it to your clipboard.

       

• A Censys Platform Personal Access Token (PAT). Instructions on how to create and manage PATs are available in the API documentation.

Installation and configuration

To set up the Censys integration, you must add the Censys integration connection, create global variables for the integration to use your organization ID in all API calls and optionally to use the host enrichment API, create a SentinelOne connection for adding notes to alerts, and create a SentinelOne SIEM HTTP Event Collector (HEC) connection to ingest Censys data into the Singularity Data Lake (SDL).

After you set up the integration's connections, you must configure the workflows to use your new connections. See the Workflow configuration section below this for more information.

1. Add the Censys connection to SentinelOne

1. Access your SentinelOne dashboard as a user with permissions described above. Go to Hyperautomation > Integrations.
2. Search for "Censys". Select the Censys card and click Add Connection.
3. On the "Create Connection" page, under "Authentication," enter your Censys PAT in the "API Key" field.
4. Leave all other options at their default settings and click Create Connection.

2. Create global variables for the Censys integration

1. On the Integrations page, select Variables. Click Create New.
2. In the "Name" field, enter Censys-Org-Id. Note that this name value is case sensitive.
3. In the "Value" field, paste your Censys organization ID.
4. Click Create.

Optional: configure host enrichment API global variable

You may also configure a global variable to use the host enrichment API endpoint instead of the get host API endpoint when retrieving information about hosts. The host enrichment API returns a curated set of host IPv4 or IPv6 data designed specifically for high-volume, automated lookups in SOC environments.

If you do not configure this global variable, then the integration workflows will use the get host API.

To use the host enrichment API, your organization must be on the Core plan. The host enrichment API does not cost credits to use. Core organizations are limited to 20,000 host enrichment calls per day. Core + Unlimited Enrichment organizations may perform an unlimited number of host enrichment API calls.

If you configure this variable, then the SentinelOne workflows will call this endpoint by default when enriching hosts. If you hit your limit, then it will fall back to the get host endpoint.

To configure the host enrichment API variable:

1. On the Integrations page, select Variables. Click Create New.
2. In the "Name" field, enter Censys-Use-Host-Enrichment-API. Note that this name value is case-sensitive.
3. In the "Value" field, enter true.
4. Click Create.

3. Create SentinelOne connection for adding notes to alerts

1. Go to Hyperautomation > Integrations.
2. Search for "SentinelOne." Select the SentinelOne card and click Add Connection.
3. On the "Create Connection" page:
   • In the "Connection Name" field, enter a name like "SentinelOne."
   • Under "Network," in the "URL" field, enter your SentinelOne management console URL.
   • Under "Authentication," in the "API Token" field, enter a SentinelOne API token with permission to read and update alerts.
     • To create an API token for a user, go to User Management > Console Users or User Management > Service Users. Select the user you want to create a token for, then click Actions > API token operations > Generate API token.
4. Click Create Connection.

4. Create SentinelOne SIEM HEC connection to ingest Censys data into SDL

1. Go to Hyperautomation > Integrations.
2. Search for "SentinelOne SDL." Select the SentinelOne SDL card and click Add Connection.
3. On the "Create Connection" page:
   • In the "Connection Name" field, enter a name like "SentinelOne SDL."
   • Under "Network," in the "URL" field, enter your HEC ingest URL, like https://ingest.us1.sentinelone.net.
   • Under "Authentication," in the "API Token" field, enter your SIEM write token.
4. Click Create Connection.

Workflows and actions

The Censys for SentinelOne integration includes the following workflows.

The integration also adds the following actions. Many of these actions are included in the pre-built workflows.

Workflow configuration

Use the following steps to add connections to your workflows and activate them. You must configure any step in a workflow that makes a Censys API call to use the connections you created above.

To add connections to a workflow:

1. Go to Hyperautomation > Workflows.

2. Open the workflow you want to edit.

3. Click on any step that makes a Censys API call (such as Get Host, Get Certificate, Get Web Property, Initiate Live Rescan, and Get Host History).

4. In the step's settings panel, set the Set as Integration toggle to On.

5. In the dropdown beneath "Set as Integration," select Censys.

6. In the "Connection Information" section, select the Censys connection you created during the "Add the Censys connection to SentinelOne" part of the setup process.

   
   1. Repeat this for all steps that call the Censys API.

7. Click on any step that sends data to the SDL (such as Send Certificate Log Entry to SDL, Send Host Log Entry to SDL, Send Host History to SDL, and Send Host Enrichment Data to SDL).

8. In the step's settings panel, set the Set as Integration toggle to On.

9. In the dropdown beneath "Set as Integration," select SentinelOne SDL.

10. In the dropdown beneath "Set as Integration," select the SentinelOne SDL connection you created during the "Create SentinelOne SIEM HEC connection to ingest Censys data into SDL" part of the setup process.

    
    1. Repeat this for all steps that send data to SDL.

11. Click on any step that adds a note to an alert (such as Add Certificate Hash Note to Alert).

12. In the step's settings panel, set the Set as Integration toggle to On.

13. In the dropdown beneath "Set as Integration," select SentinelOne.

14. In the dropdown beneath "Set as Integration," select the SentinelOne connection you created during the "Create SentinelOne connection for adding notes to alerts" part of the setup process.

    
    1. Repeat this for all steps that add notes to alerts.

15. After configuring each step, click Activate.

How to use Censys for SentinelOne workflows

Censys Alert Enrichment

This workflow runs automatically. No manual action is needed. Whenever a MEDIUM, HIGH, or CRITICAL alert is created in SentinelOne, the workflow triggers and enriches it with Censys data.

Censys Alert Enrichment (Manual)

1. Open the workflow and click Execute.
2. Fill in the prompt fields:
   • Alert ID (optional): the SentinelOne alert ID to attach the enrichment note to.
   • Host (optional): IP address of the host to look up (such as 8.8.8.8).
   • Web Property (optional): Hostname and port pair of the web property to look up (such as example.com:443).
   • Certificate (optional): Certificate SHA256 hash to look up.
3. Click Run.

Censys Host History Enrichment

1. Open the workflow and click Execute.
2. Fill in the prompt fields:
   • Alert ID (optional): the SentinelOne alert ID to attach the enrichment note to.
   • Host: IP address of the host to look up.
   • Start time: history start date in the format YYYY-MM-DDTHH:MM:SSZ (for example, 2024-01-01T00:00:00Z).
   • End time: history end date in the same format.
3. Click Run.

Censys Rescan

1. Open the workflow and click Execute.
2. Fill in the prompt fields:
   • Alert ID (optional): the SentinelOne alert ID to attach the findings to.
   • Scan Type: enter S to scan a host service (IP, port, and protocol), or WP to scan a web property (hostname and port).
   • Host: IP address or hostname (for example 8.8.8.8 or www.example.com).
   • Port: Port number.
   • Protocol: The protocol of the target service (required for service scans), such as HTTP.
   • Transport protocol: The transport protocl of the target service (required for Service scans), such as tcp.
3. Click Run. The workflow will poll Censys for scan completion (up to 10 minutes) and then ingest the results.

Censys Related Infrastructure

1. Open the workflow and click Execute.
2. Fill in the prompt fields:
   • Alert ID (optional): the SentinelOne alert ID to attach the findings note to.
   • Host IP (optional): Host IP address to pivot from.
   • Web Property (optional): Web property to pivot from.
   • Certificate (optional): Certificate SHA256 hash to pivot from.
3. Click Run. The workflow will poll Censys until the threat hunting job completes (up to 10 minutes), then ingest the results.

Data written to the SDL

All workflows ingest Censys raw data into the Singularity Data Lake under the following source metadata:

You can query this data in the SDL using a filter such as:

dataSource.vendor='Censys' dataSource.category='HostEnrichment'