SentinelOne Solution version 3.0.5 issue with the SentinelOne (using Azure Functions) Data Connector

[q0njg3m1]

We are running the latest SentinelOne Solution (version 3.0.5) and we've noticed a strange behavior with the SentinelOne (using Azure Functions) Data Connector. The connector looks ok if you view it inside the Solution in the Content Hub:

But here is what is shown when you click the Open connector page button:

It shows the description and configuration of the new data connector: SentinelOne (Preview), including the new tables: SentinelOneActivities_CL, SentinelOneAgents_CL, SentinelOneGroups_CL, SentinelOneThreats_CL and SentinelOneAlerts_CL.

Also it shows as Connected even if we don't have any data in these new table.
Maybe it's referencing the correct table (SentinelOne_CL) even though it shows the new tables and the description for the new SentinelOne (Preview) data connector (the one using Microsoft Sentinel Codeless Connector Platform).

Same thing is visible in the Data Connectors page:

Please advise on how can we see the configuration for the old data connector: SentinelOne (using Azure Functions).
Thanks!

[v-mabrindha]

Please follow the below instruction to resolve this issue.

Scenario 1 -

1.Reinstall the solution,

2. Check SentinelOne(preview) behaviour ,

3. Check with open connector page, Both description and inside connector page should be same.

4. Check for SentinelOne (using Azure functions),

5. Check with open connector page , Both description and inside connector page should be same.

Scenario 2 -

1.Go for workspace , Configuration ->Data Connector, delete the connectors

2. Reinstall the solution SentinelOne solution

3. Check the data connectors through manage.

let us know if this resolves your issue.

Thanks.

[q0njg3m1]

Hi @v-mabrindha,

Scenario 1 (only re-installing the SentinelOne Solution) didn't solve the issue.

Trying Scenario 2 (delete the Data Connectors then re-install the Solution) it says:

"Delete Data Connector
The data connector is currently connected and cannot be deleted. Please disconnect first and then delete.
Note that after disconnecting it may take some time until the connector status will change to disconnected."

What exactly happens if we disconnect then delete the data connector? We have two Function Apps created from the "SentinelOne (using Azure Functions)" Data Connector that are ingesting the logs from two SentinelOne consoles into this workspaces.
Will data ingestion continue even if we disconnect and delete the data connector?

Also as you can see from the screenshot the connector name is not listed as "SentinelOne (using Azure Functions)" anymore but just "SentinelOne".

Thanks!