SentinelOne

This document describes the procedure for configuring the SentinelOne connector to retrieve information via the SentinelOne API.

Objective

The purpose of this connector is to provide a method for retrieving the following information:

• Tenant URL
• API Token + expiration date

Prerequisites

• Access to the SentinelOne portal with the required permissions.

Procedure

Generate API Token

1. Access the SentinelOne portal:
   • Log in to the SentinelOne portal with administrator or account owner rights.
2. Navigate to API Token Settings:
   • Click on User menu (top right).
   • Select My User or your user account.
   • Go to Options section.
3. Generate API Token:
   • Click Generate API Token.
   • Review the token permissions.
   • Copy the generated API Token immediately.
   • Store the token securely.
4. Note the Tenant URL:
   • Your tenant URL will be visible in the portal (e.g., https://usea1-api.sentinelone.net).
   • Store this URL for OverSOC configuration.

Configure in OverSOC

1. In OverSOC, go to Data Sources Settings > Sources.
2. Select SentinelOne and click Configure.
3. Enter the Tenant URL (e.g., https://usea1-api.sentinelone.net).
4. Paste the API Token in the authentication field.
5. Click Save Configuration.

Official Documentation

The API token generation guide is available from within the SentinelOne Management Console under User > My User > Options. For additional details, contact your SentinelOne support representative.