SentinelOne
Configure the SentinelOne connector to retrieve information via the SentinelOne API
This document describes the procedure for configuring the SentinelOne connector to retrieve information via the SentinelOne API.
Objective
The purpose of this connector is to provide a method for retrieving the following information:
- Tenant URL
- API Token + expiration date
Prerequisites
- Access to the SentinelOne portal with the required permissions.
Information to provide in OverView
| Field | Description |
|---|---|
| API Token | SentinelOne API authentication token |
| Console URL | SentinelOne console URL |
Parameters
These parameters are optional. Leave them at their default value unless you have a specific reason to change them.
| Parameter | Description | Default |
|---|---|---|
| Retrieve Vulnerabilities | Retrieve vulnerabilities from the SentinelOne API | Enabled |
| Retrieve Vulnerabilities from XSPM | Retrieve vulnerabilities from the XSPM Vulnerabilities API instead of Application Risk. With a Singularity Vulnerability Management licence, each vulnerability also carries its EPSS score, its CISA KEV status and the fixed version. Severities then match the Vulnerabilities page of the SentinelOne console. The API token must have access to XSPM; otherwise the connection check fails. | Disabled |
| Retrieve Rogue Assets | Retrieve rogue assets from the SentinelOne API | Disabled |
| Resolved Alerts Retention (days) | Retention period for resolved alerts in days | 30 |
Procedure
Generate API Token
- Access the SentinelOne portal:
- Log in to the SentinelOne portal with administrator or account owner rights.
- Navigate to API Token Settings:
- Click on User menu (top right).
- Select My User or your user account.
- Go to Options section.
- Generate API Token:
- Click Generate API Token.
- Review the token permissions.
- Copy the generated API Token immediately.
- Store the token securely.
- Note the Tenant URL:
- Your tenant URL will be visible in the portal (e.g., https://usea1-api.sentinelone.net).
- Store this URL for OverView configuration.
Configure in OverView
- In OverView, go to Data Sources Settings > Sources.
- Select SentinelOne and click Configure.
- Enter the Tenant URL (e.g., https://usea1-api.sentinelone.net).
- Paste the API Token in the authentication field.
- Click Save Configuration.
Alternative: file import through DropPoint
The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to SentinelOne.
Bucket : s3://sentinelone/
Example : s3://sentinelone/export.csv
The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.
Official Documentation
The API token generation guide is available from within the SentinelOne Management Console under User > My User > Options. For additional details, contact your SentinelOne support representative.