How to Export SentinelOne Singularity Data Lake Logs for Investigation
Summary
A practical guide to exporting SentinelOne Singularity Data Lake events via PowerQuery or the console, converting API results to JSONL, and troubleshooting permissions, scope, regional URLs, and result limits.
Key points
- Create a service user with SDL Query API and SDL Search permissions at the account or site that holds the data.
- Use the regional Data Lake API and PowerQuery to select fields and export event results; split long time windows when results hit limits.
- Convert the API's columns-and-rows response into one JSON object per event with jq.
- The console's Event Search can export events in CSV and, depending on version and search mode, JSON or plain text.
- Preserve command-line and process-name fields for endpoint telemetry, and retain the message field for third-party logs.
- Troubleshooting guidance links empty results to incorrect service-user scope, authentication errors to token or permissions, and connection errors to the regional URL.
Article Details
- Defense Focus
- Export SentinelOne Singularity Data Lake endpoint and third-party logs for investigation in LogTotal.
- Detection Methods
- Query events by endpoint and time range using PowerQuery, then inspect event types, process names, and source and target process command lines.
- Use Event Search to test queries, verify field names, review matching events, and select fields before exporting.
- Preserve individual events rather than using aggregation when event-level investigation is needed.
- Data Sources
- SentinelOne endpoint telemetry, including endpoint.name, event.type, src.process.cmdline, and tgt.process.cmdline
- Third-party logs stored in the Data Lake, including the original text in the message field
- Rule Types
- PowerQuery search filters and queries
- Platforms
- SentinelOne Singularity Data Lake API
- SentinelOne Singularity console Event Search
- LogTotal
- Defensive Actions
- Create an API service user with SDL Query API and SDL Search permissions at the account or site that contains the data.
- Use the regional Data Lake URL listed in the console help section.
- Test queries in Event Search and confirm field names for each data source.
- Keep process names and command-line fields when exporting endpoint telemetry; preserve the message field for third-party logs.
- Prefer JSON for structured endpoint telemetry when available, and convert tabular API results into one JSON object per event for review.
- Split large API time windows into multiple requests; narrow the time range or use the API if UI export limits are reached.