Overview

This pack processes SentinelOne EDR events sent to Exabeam and samples high-volume event types to reduce ingest costs.

What this pack does:

• Drops Not Reported events
• Samples DNS and module load
• Keeps threat and process detail