SentinelOne

integrations endpoints sentinelone edr

Use the following instructions to configure an integration between SentinelOne and Secureworks® Taegis™ XDR. The instructions are based on Version V of SentinelOne Management Console.

Data Provided from Integration ⫘

	Alerts	Auth	DNS	File Collection	HTTP	NIDS	Netflow	Process	File Modification	API Call	Registry	Scriptblock	Management	Persistence	Thread Injection
SentinelOne	✓	✓	✓		✓		✓	✓	✓	✓	✓	✓		✓	✓

Create a Service User in SentinelOne Management Console ⫘

Create a Role for the Service User ⫘

1. In the SentinelOne Management Console, navigate to Settings → USERS → Roles.
2. Select the built-in Viewer role, then choose Duplicate Role in the Actions drop down menu.

Duplicate Viewer Role

3. Choose a name for the new user role then select Next.

Choose Role Name

4. Select Cloud Funnel in the left pane. Choose Select All to allow full access to Cloud Funnel, then select Save.

Allow Full Access to Cloud Funnel

Create a Service User ⫘

5. In the SentinelOne Management Console, navigate to Settings→USERS→Service Users. Choose Create New Service User from the Actions drop down menu.

Create New Service User

Configure the Basic Parameters of the Service User ⫘

6. Add a Name. This identifies the user in SentinelOne Management Console. The name cannot have an equal sign (=) or angle bracket characters ( <, >).
7. Enter an optional Description to identify the user.
8. Set the Expiration Date of the API token. The default is one year. Select Custom to set a different date and time.

9. When you’re done with the basic parameters, select Next.

Configure Service User Basics

Configure the Scope of Access of the Service User ⫘

10. Under Access Level, select the Account tile.
11. Under Accounts Selected, select the account to be integrated with XDR, and the role created in the step above, Create a Role For the Service User.
12. Select Create User.

Configure Service User Scope

13. Securely copy the API token associated with the service user, then choose Close.

Copy API Token

Configure SentinelOne Deep Visibility Policy ⫘

14. In the SentinelOne Management Console, navigate to Sentinels → POLICY.
15. Find the Deep Visibility section and ensure that Enable Deep Visibility option is selected.

XDR integration supports the following Deep Visibility event categories:

• Process
• DNS
• Registry Keys
• Command Scripts
• File
• IP
• Scheduled Tasks
• Cross Process
• URL
• Login
• Behavioral Indicators
• Module (may not be configurable in the policy)

If you want the integration to ingest these event categories, select the corresponding options in the Deep Visibility Policy. Ensure that all event types in these categories are selected in Event Type Configuration as well.

16. Select Save Changes to save any changes.

Configure Deep Visibility Policy

Create Your SentinelOne Integration in XDR ⫘

17. In XDR, navigate to Integrations→Cloud APIs, then choose Add API Integration from the top right corner.

18. Choose Set Up SentinelOne.

19. Enter a Name. This is how the integration is identified in XDR.

20. Enter the Management Console URL. This is the address of your SentinelOne Management Console. For example, usea1-999-example.sentinelone.net.
21. Add the API Token. This is the API token you securely copied from Copy API Token above.
22. Add the Account ID. This is the ID of the SentinelOne account to be integrated with XDR.
23. When satisfied with the above configuration, select Add.

Add XDR Integration