diff --git a/packages/sentinel_one_cloud_funnel/_dev/build/docs/README.md b/packages/sentinel_one_cloud_funnel/_dev/build/docs/README.md
index fcbf6b5c581..ae89ff2614b 100644
--- a/packages/sentinel_one_cloud_funnel/_dev/build/docs/README.md
+++ b/packages/sentinel_one_cloud_funnel/_dev/build/docs/README.md
@@ -97,6 +97,19 @@ A sample JSON Credentials file looks as follows:
 3. To configure event notifications for an S3 bucket, check [this guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html).
    - While creating `event notification` select the event type as `s3:ObjectCreated:*`, destination type `SQS Queue`, and select the queue name created in Step 2.
 
+### Collect data from an S3-compatible service (MinIO, Ceph, ...)
+
+1. Enable the **Collect logs via S3 Bucket** toggle. The S3-compatible options below only
+   take effect in bucket-polling mode; with the toggle off the agent runs in SQS mode and
+   ignores the Non-AWS Bucket Name.
+2. Under **Advanced options**, instead of a Bucket ARN or Access Point ARN, set:
+   - **[S3] Non-AWS Bucket Name** — the bucket name on the S3-compatible service.
+   - **Endpoint** — the full service URI, including the scheme, for example `https://s3.example.com:9000`.
+   - **Region** — required whenever a Non-AWS Bucket Name is set.
+   - **Path Style** — enable this; S3-compatible services generally require path-style access.
+
+Authentication must use **Access Key ID** and **Secret Access Key**; IAM roles and shared credential profiles are AWS-only.
+
 ### Collect data from an Azure Blob Storage
 
 - Considering you already have an Blob Storage setup, to configure it with SentinelOne Cloud Funnel, follow the steps mentioned here: `[Your Login URL]/docs/en/how-to-configure-your-amazon-s3-bucket.html`.
diff --git a/packages/sentinel_one_cloud_funnel/changelog.yml b/packages/sentinel_one_cloud_funnel/changelog.yml
index ff2cf306784..b94e1227145 100644
--- a/packages/sentinel_one_cloud_funnel/changelog.yml
+++ b/packages/sentinel_one_cloud_funnel/changelog.yml
@@ -1,4 +1,15 @@
 # newer versions go on top
+- version: "1.14.0"
+  changes:
+    - description: Fix event.dataset constant_keyword values for routing target data streams, allowing rerouted events to be correctly indexed.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20467
+    - description: Add dynamic_dataset and dynamic_namespace to event data stream so Fleet grants the agent write permissions to routing targets.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20467
+    - description: Add endpoint, path_style, region, and non_aws_bucket_name configuration options for S3-compatible storage services.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20467
 - version: "1.13.1"
   changes:
     - description: Remove duplicated installation instructions from the documentation
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/command_script/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/command_script/fields/base-fields.yml
index 881a2594da2..9b0eea22cc5 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/command_script/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/command_script/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.command_script
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/cross_process/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/cross_process/fields/base-fields.yml
index 881a2594da2..0aefd73c751 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/cross_process/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/cross_process/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.cross_process
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/dns/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/dns/fields/base-fields.yml
index 881a2594da2..e90145fe9e3 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/dns/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/dns/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.dns
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/scripts/env.txt b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/scripts/env.txt
new file mode 100644
index 00000000000..2e2aa8df0fd
--- /dev/null
+++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/scripts/env.txt
@@ -0,0 +1,10 @@
+[!exec:echo] skip 'Skipping test requiring absent echo command'
+
+exec echo ${PACKAGE_NAME}
+stdout '^sentinel_one_cloud_funnel$'
+
+exec echo ${DATA_STREAM}
+stdout '^event$'
+
+exec echo ${CURRENT_VERSION}
+stdout '^[0-9]+\.[0-9]+\.[0-9]+$'
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/scripts/routed_data_streams.txt b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/scripts/routed_data_streams.txt
new file mode 100644
index 00000000000..d3a9c46cdde
--- /dev/null
+++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/scripts/routed_data_streams.txt
@@ -0,0 +1,97 @@
+# Verify that events are correctly routed from the event data stream to
+# category-specific data streams via routing rules when rerouting is enabled.
+#
+# The test data in minio provides:
+#   - 2 dns events        → sentinel_one_cloud_funnel.dns (rerouted)
+#   - 1 process event     → sentinel_one_cloud_funnel.process (rerouted)
+#   - 1 file event        → sentinel_one_cloud_funnel.event (retained, reroute_file not enabled)
+
+[!external_stack] skip 'Skipping external stack test.'
+[!exec:jq] skip 'Skipping test requiring absent jq command'
+
+# Connect to the running stack.
+use_stack -profile ${CONFIG_PROFILES}/${PROFILE}
+
+# Install an agent.
+install_agent -profile ${CONFIG_PROFILES}/${PROFILE} -network_name NETWORK_NAME
+
+# Start the minio service with pre-loaded test data.
+docker_up -profile ${CONFIG_PROFILES}/${PROFILE} -network ${NETWORK_NAME} s1cf-minio
+
+# Add the package resources.
+add_package -profile ${CONFIG_PROFILES}/${PROFILE}
+
+# Add the data stream policy with S3 polling against minio.
+add_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} test_config.yaml EVENT_DS
+
+# The file event should remain in the event data stream (reroute_file not enabled).
+get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 1 -confirm 30s -timeout 5m ${EVENT_DS}
+cp stdout event_docs.json
+exec jq '.hits.hits[0]._source.sentinel_one_cloud_funnel.event.category' event_docs.json
+stdout 'file'
+
+# DNS events should be routed to the dns data stream.
+get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 2 -confirm 15s -timeout 2m logs-sentinel_one_cloud_funnel.dns-*
+cp stdout dns_docs.json
+exec jq -c '[.hits.hits[]._source.sentinel_one_cloud_funnel.event.category] | unique' dns_docs.json
+stdout '\["dns"\]'
+
+# Process events should be routed to the process data stream.
+get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 1 -confirm 15s -timeout 2m logs-sentinel_one_cloud_funnel.process-*
+cp stdout proc_docs.json
+exec jq '.hits.hits[0]._source.sentinel_one_cloud_funnel.event.category' proc_docs.json
+stdout 'process'
+
+# Clean up.
+remove_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} ${EVENT_DS}
+uninstall_agent -profile ${CONFIG_PROFILES}/${PROFILE} -timeout 1m
+docker_down s1cf-minio
+
+-- test_config.yaml --
+input: aws-s3
+vars:
+  collect_s3_logs: true
+  non_aws_bucket_name: test-bucket
+  endpoint: http://svc-s1cf-minio:9000
+  access_key_id: minioadmin
+  secret_access_key: minioadmin
+  path_style: true
+  region: us-east-1
+  reroute_dns: true
+  reroute_process: true
+data_stream:
+  vars:
+    preserve_original_event: true
+    interval: 10s
+
+-- s1cf-minio/docker-compose.yml --
+services:
+  s1cf-minio:
+    image: minio/minio:RELEASE.2024-06-13T22-53-53Z
+    environment:
+      MINIO_ROOT_USER: minioadmin
+      MINIO_ROOT_PASSWORD: minioadmin
+    entrypoint: /bin/sh
+    command:
+      - -c
+      - |
+        minio server /data &
+        MINIO_PID=$$!
+        until curl -sf http://localhost:9000/minio/health/live; do sleep 1; done
+        mc alias set local http://localhost:9000 minioadmin minioadmin
+        mc mb local/test-bucket
+        mc cp /testdata/events.ndjson local/test-bucket/s1/cloud_funnel/events.ndjson
+        wait $$MINIO_PID
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    volumes:
+      - ./testdata:/testdata:ro
+
+-- s1cf-minio/testdata/events.ndjson --
+{"event.category":"dns","event.time":1664811149495,"event.id":"TEST_DNS_001","event.type":"DNS Resolved","meta.event.name":"DNS","site.id":"123456789","account.id":"123456789","endpoint.name":"test-host","endpoint.os":"windows","endpoint.type":"laptop","agent.uuid":"test-agent-1","agent.version":"22.1.2.217","mgmt.id":"1337","mgmt.url":"test.sentinelone.org","os.name":"Windows10Pro","src.process.name":"chrome.exe","src.process.pid":1234,"src.process.uid":"AAAA0000","process.unique.key":"AAAA0000","trace.id":"TEST_DNS_001","packet.id":"PKT001","event.dns.request":"example.com","event.dns.response":"93.184.216.34","dataSource.name":"SentinelOne","dataSource.category":"security","i.scheme":"edr","i.version":"preprocess-lib-1.0","site.name":"TEST","group.id":"test-group","sca:atlantisIngestTime":1664811166298,"sca:ingestTime":1664811166,"timestamp":"18:32:29.495"}
+{"event.category":"dns","event.time":1664811150000,"event.id":"TEST_DNS_002","event.type":"DNS Resolved","meta.event.name":"DNS","site.id":"123456789","account.id":"123456789","endpoint.name":"test-host","endpoint.os":"windows","endpoint.type":"laptop","agent.uuid":"test-agent-1","agent.version":"22.1.2.217","mgmt.id":"1337","mgmt.url":"test.sentinelone.org","os.name":"Windows10Pro","src.process.name":"firefox.exe","src.process.pid":5678,"src.process.uid":"BBBB0000","process.unique.key":"BBBB0000","trace.id":"TEST_DNS_002","packet.id":"PKT002","event.dns.request":"elastic.co","event.dns.response":"34.120.115.39","dataSource.name":"SentinelOne","dataSource.category":"security","i.scheme":"edr","i.version":"preprocess-lib-1.0","site.name":"TEST","group.id":"test-group","sca:atlantisIngestTime":1664811166298,"sca:ingestTime":1664811166,"timestamp":"18:32:30.000"}
+{"event.category":"process","event.time":1664811149470,"event.id":"TEST_PROC_001","event.type":"ProcessCreation","meta.event.name":"PROCESSCREATION","site.id":"123456789","account.id":"123456789","endpoint.name":"test-host","endpoint.os":"windows","endpoint.type":"server","agent.uuid":"test-agent-1","agent.version":"22.1.2.217","mgmt.id":"1337","mgmt.url":"test.sentinelone.org","os.name":"WindowsServer2019","src.process.name":"svchost.exe","src.process.pid":776,"src.process.uid":"CCCC0000","process.unique.key":"CCCC0000","trace.id":"TEST_PROC_001","packet.id":"PKT003","tgt.process.name":"notepad.exe","tgt.process.pid":9999,"tgt.process.uid":"DDDD0000","dataSource.name":"SentinelOne","dataSource.category":"security","i.scheme":"edr","i.version":"preprocess-lib-1.0","site.name":"TEST","group.id":"test-group","sca:atlantisIngestTime":1664811166298,"sca:ingestTime":1664811166,"timestamp":"18:32:29.470"}
+{"event.category":"file","event.time":1664811149488,"event.id":"TEST_FILE_001","event.type":"FileCreation","meta.event.name":"FILECREATION","site.id":"123456789","account.id":"123456789","endpoint.name":"test-host","endpoint.os":"windows","endpoint.type":"desktop","agent.uuid":"test-agent-1","agent.version":"22.1.2.217","mgmt.id":"1337","mgmt.url":"test.sentinelone.org","os.name":"Windows10Pro","src.process.name":"explorer.exe","src.process.pid":2222,"src.process.uid":"EEEE0000","process.unique.key":"EEEE0000","trace.id":"TEST_FILE_001","packet.id":"PKT004","tgt.file.path":"C:\\Users\\test\\Documents\\test.txt","tgt.file.type":"UNKNOWN","dataSource.name":"SentinelOne","dataSource.category":"security","i.scheme":"edr","i.version":"preprocess-lib-1.0","site.name":"TEST","group.id":"test-group","sca:atlantisIngestTime":1664811166298,"sca:ingestTime":1664811166,"timestamp":"18:32:29.488"}
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/agent/stream/aws-s3.yml.hbs b/packages/sentinel_one_cloud_funnel/data_stream/event/agent/stream/aws-s3.yml.hbs
index 9ae2eecba58..17235d87779 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/event/agent/stream/aws-s3.yml.hbs
+++ b/packages/sentinel_one_cloud_funnel/data_stream/event/agent/stream/aws-s3.yml.hbs
@@ -4,6 +4,8 @@
 bucket_arn: {{bucket_arn}}
 {{else if access_point_arn}}
 access_point_arn: {{access_point_arn}}
+{{else if non_aws_bucket_name}}
+non_aws_bucket_name: {{non_aws_bucket_name}}
 {{/if}}
 {{#if interval}}
 bucket_list_interval: {{interval}}
@@ -68,6 +70,15 @@ fips_enabled: {{fips_enabled}}
 {{#if proxy_url}}
 proxy_url: {{proxy_url}}
 {{/if}}
+{{#if endpoint}}
+endpoint: {{endpoint}}
+{{/if}}
+{{#if path_style}}
+path_style: {{path_style}}
+{{/if}}
+{{#if region}}
+region: {{region}}
+{{/if}}
 {{#if ssl}}
 ssl: {{ssl}}
 {{/if}}
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml
index a90cf5bd5cf..e9ac29e546d 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml
@@ -1,5 +1,7 @@
 title: Collect Event logs from SentinelOne Cloud Funnel.
 elasticsearch:
+  dynamic_dataset: true
+  dynamic_namespace: true
   index_template:
     settings:
       analysis:
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/file/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/file/fields/base-fields.yml
index 881a2594da2..f7a3fe43b22 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/file/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/file/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.file
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/indicators/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/indicators/fields/base-fields.yml
index 881a2594da2..7b08bdb5b84 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/indicators/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/indicators/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.indicators
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/ip/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/ip/fields/base-fields.yml
index 881a2594da2..990e33b79ec 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/ip/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/ip/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.ip
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/logins/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/logins/fields/base-fields.yml
index 881a2594da2..927a019ccac 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/logins/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/logins/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.logins
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/logins/manifest.yml b/packages/sentinel_one_cloud_funnel/data_stream/logins/manifest.yml
index a13b4b3cf09..b2589ca5a83 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/logins/manifest.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/logins/manifest.yml
@@ -1,5 +1,5 @@
 title: SentinelOne Cloud Funnel Logins Events
-dataset: sentinel_one_cloud_funnel.login
+dataset: sentinel_one_cloud_funnel.logins
 type: logs
 elasticsearch:
   index_template:
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/module/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/module/fields/base-fields.yml
index 881a2594da2..cf874890764 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/module/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/module/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.module
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/process/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/process/fields/base-fields.yml
index 881a2594da2..66607abc00d 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/process/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/process/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.process
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/registry/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/registry/fields/base-fields.yml
index 881a2594da2..18fa5fbc05e 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/registry/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/registry/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.registry
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/scheduled_task/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/scheduled_task/fields/base-fields.yml
index 881a2594da2..cf4169f9ce2 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/scheduled_task/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/scheduled_task/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.scheduled_task
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/threat_intelligence_indicators/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/threat_intelligence_indicators/fields/base-fields.yml
index 881a2594da2..29191f2ab9e 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/threat_intelligence_indicators/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/threat_intelligence_indicators/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.threat_intelligence_indicators
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/data_stream/url/fields/base-fields.yml b/packages/sentinel_one_cloud_funnel/data_stream/url/fields/base-fields.yml
index 881a2594da2..9124afd0ce1 100644
--- a/packages/sentinel_one_cloud_funnel/data_stream/url/fields/base-fields.yml
+++ b/packages/sentinel_one_cloud_funnel/data_stream/url/fields/base-fields.yml
@@ -14,7 +14,7 @@
 - name: event.dataset
   type: constant_keyword
   description: Event dataset.
-  value: sentinel_one_cloud_funnel.event
+  value: sentinel_one_cloud_funnel.url
 - name: '@timestamp'
   type: date
   description: Event timestamp.
diff --git a/packages/sentinel_one_cloud_funnel/docs/README.md b/packages/sentinel_one_cloud_funnel/docs/README.md
index 9cda45ef63e..e071d5f6731 100644
--- a/packages/sentinel_one_cloud_funnel/docs/README.md
+++ b/packages/sentinel_one_cloud_funnel/docs/README.md
@@ -97,6 +97,19 @@ A sample JSON Credentials file looks as follows:
 3. To configure event notifications for an S3 bucket, check [this guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html).
    - While creating `event notification` select the event type as `s3:ObjectCreated:*`, destination type `SQS Queue`, and select the queue name created in Step 2.
 
+### Collect data from an S3-compatible service (MinIO, Ceph, ...)
+
+1. Enable the **Collect logs via S3 Bucket** toggle. The S3-compatible options below only
+   take effect in bucket-polling mode; with the toggle off the agent runs in SQS mode and
+   ignores the Non-AWS Bucket Name.
+2. Under **Advanced options**, instead of a Bucket ARN or Access Point ARN, set:
+   - **[S3] Non-AWS Bucket Name** — the bucket name on the S3-compatible service.
+   - **Endpoint** — the full service URI, including the scheme, for example `https://s3.example.com:9000`.
+   - **Region** — required whenever a Non-AWS Bucket Name is set.
+   - **Path Style** — enable this; S3-compatible services generally require path-style access.
+
+Authentication must use **Access Key ID** and **Secret Access Key**; IAM roles and shared credential profiles are AWS-only.
+
 ### Collect data from an Azure Blob Storage
 
 - Considering you already have an Blob Storage setup, to configure it with SentinelOne Cloud Funnel, follow the steps mentioned here: `[Your Login URL]/docs/en/how-to-configure-your-amazon-s3-bucket.html`.
diff --git a/packages/sentinel_one_cloud_funnel/manifest.yml b/packages/sentinel_one_cloud_funnel/manifest.yml
index 389daa797ae..30f8a6a8d23 100644
--- a/packages/sentinel_one_cloud_funnel/manifest.yml
+++ b/packages/sentinel_one_cloud_funnel/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: sentinel_one_cloud_funnel
 title: SentinelOne Cloud Funnel
-version: "1.13.1"
+version: "1.14.0"
 description: Collect logs from SentinelOne Cloud Funnel with Elastic Agent.
 type: integration
 categories: 
@@ -65,14 +65,21 @@ policy_templates:
             multi: false
             required: false
             show_user: true
-            description: ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.
+            description: ARN of the AWS S3 bucket that will be polled for list operation. Required for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN, or a Non-AWS Bucket Name for an S3-compatible service. In case both configurations are added, this one takes precedence.
           - name: access_point_arn
             type: text
             title: "[S3] Access Point ARN"
             multi: false
             required: false
             show_user: true
-            description: ARN of the AWS S3 Access Point that will be polled for list operation. Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.
+            description: ARN of the AWS S3 Access Point that will be polled for list operation. Required for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN, or a Non-AWS Bucket Name for an S3-compatible service.
+          - name: non_aws_bucket_name
+            type: text
+            title: "[S3] Non-AWS Bucket Name"
+            multi: false
+            required: false
+            show_user: false
+            description: Name of the S3 bucket for use with S3-compatible services (e.g. MinIO, Ceph). Use instead of Bucket ARN when not connecting to AWS S3.
           - name: queue_url
             type: text
             title: "[SQS] Queue URL"
@@ -169,6 +176,30 @@ policy_templates:
               #    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk
               #    sxSmbIUfc2SGJGCJD4I=
               #    -----END CERTIFICATE-----
+          - name: endpoint
+            type: text
+            title: Endpoint
+            multi: false
+            required: false
+            show_user: false
+            default: ""
+            description: URL of the entry point for an AWS web service. If set, the input will use this endpoint instead of the default AWS endpoint.
+          - name: path_style
+            type: bool
+            title: Path Style
+            multi: false
+            required: false
+            show_user: false
+            default: false
+            description: Enable path-style S3 access. Required when using non-AWS S3-compatible services.
+          - name: region
+            type: text
+            title: Region
+            multi: false
+            required: false
+            show_user: false
+            default: ""
+            description: AWS region for the S3 bucket. Required when using non_aws_bucket_name.
           # Rerouting options
           - name: reroute_command_script
             type: bool