SentinelOne

Visualize SentinelOne endpoint agents and devices, map SentinelOne agents to devices and owners, and monitor changes through queries and alerts.

Installation

Installation

For this integration, you will first need to acquire an API Token in SentinelOne.

Configuration in SentinelOne

To create an API Token:

1. In your SentinelOne Management Console, click Settings > USERS

2. Select your username and navigate to Edit User > API Token > Generate

3. Generate a token for use within JupiterOne.

   note

   If you see Revoke and Regenerate actions, you already have an existing token. Revoking or regenerating the existing token will break any scripts currently utilizing the revoked/regenerated token:

   • Revoke removes the token authorization, and there is no confirmation on this action.
   • Regenerate revokes the token and generates a new token. If you click Generate or Regenerate, a message shows the token string and the date that the token expires.

4. Click DOWNLOAD for use in JupiterOne.

Configuration in JupiterOne

To install the SentinelOne integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select SentinelOne. Click New Instance to begin configuring your integration.

Creating a configuration requires the following:

• The Account Name used to identify the SentinelOne account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

• Description to assist in identifying the integration instance, if desired.

• Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

• Your SentinelOne Management Server Hostname/URL and API Token.

Click Create once all values are provided to finalize the integration.

Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Data Model

Entities

The following entities are created:

Resources	Entity _type	Entity _class
Account	sentinelone_account	Account
Agent	sentinelone_agent	HostAgent
Agent	sentinelone_host	Host
Group	sentinelone_group	Group

Relationships

The following relationships are created:

Source Entity _type	Relationship _class	Target Entity _type
sentinelone_account	HAS	sentinelone_group
sentinelone_group	HAS	sentinelone_agent
sentinelone_host	HAS	sentinelone_agent

Types

Sentinelone Account

sentinelone_account inherits from Account

---

Sentinelone Agent

sentinelone_agent inherits from HostAgent

Property	Type	Description	Specifications
activeThreats	number
activeThreatsCount	number
adComputerDistinguishedName	string
agentVersion	string
allowRemoteShell	boolean
appsVulnerabilityStatus	string
computerName	string
consoleMigrationStatus	string
coreCount	number
cpuCount	number
cpuId	string
createdAt	number	Please use createdOn instead	deprecated: true
domain	string
encryptedApplications	boolean
externalIp	string
groupId *	string
groupIp	string
groupName	string
groupUpdatedAt	number	Please use groupUpdatedOn instead	deprecated: true
groupUpdatedOn	number
infected	boolean	Please use isInfected instead	deprecated: true
inRemoteShellSession	boolean	Please use isInRemoteShellSession instead	deprecated: true
isActive	boolean
isDecommissioned	boolean
isInfected	boolean
isInRemoteShellSession	boolean
isPendingUninstall	boolean
isUninstalled	boolean
isUpToDate	boolean
lastActiveDate	number
lastLoggedInUserName	string
macAddress	array of strings
macAddresses	array of strings
machineType	string
missingPermissions	array of strings
mitigationMode	string
mitigationModeSuspicious	string
modelName	string
networkStatus	string
osArch	string
osName	string
osRevision	string
osStartTime	number
osType	string
osUsername	string
policyUpdatedAt	number	Please use policyUpdatedOn instead	deprecated: true
policyUpdatedOn	number
registeredAt	number	Please use registeredOn instead	deprecated: true
registeredOn	number
scanAbortedAt	number	Please use scanAbortedOn instead	deprecated: true
scanAbortedOn	number
scanFinishedAt	number	Please use scanFinishedOn instead	deprecated: true
scanFinishedOn	number
scanStartedAt	number	Please use scanStartedOn instead	deprecated: true
scanStartedOn	number
scanStatus	string
serial	string
siteId	string
siteName	string
totalMemory	number
updatedAt	number	Please use updatedOn instead	deprecated: true
uuid	string

---

Sentinelone Group

sentinelone_group inherits from Group

Property	Type	Description	Specifications
createdAt	number	Please use createdOn instead	deprecated: true
creator	string
creatorId	string
filterId	string
filterName	string
inherits	boolean
isDefault	boolean
rank	number
siteId *	string
totalAgents	number
type	string
updatedAt	number	Please use updatedOn instead	deprecated: true

---

Sentinelone Host

sentinelone_host inherits from Host

Property	Type	Description	Specifications
adComputerDistinguishedName	string
agentVersion	string
allowRemoteShell	boolean
appsVulnerabilityStatus	string
computerName	string
consoleMigrationStatus	string
coreCount	number
cpuCount	number
cpuId	string
createdAt	number	Please use createdOn instead	deprecated: true
domain	string
encryptedApplications	boolean
externalIp	string
groupId *	string
groupIp	string
groupName	string
groupUpdatedOn	number
inRemoteShellSession	boolean	Please use isInRemoteShellSession instead	deprecated: true
isActive	boolean
isDecommissioned	boolean
isInRemoteShellSession	boolean
isPendingUninstall	boolean
isUninstalled	boolean
isUpToDate	boolean
lastActiveDate	number
lastLoggedInUserName	string
machineType	string
missingPermissions	array of strings
mitigationMode	string
mitigationModeSuspicious	string
modelName	string
osArch	string
osRevision	string
osStartTimeOn	number
osUsername	string
policyUpdatedOn	number
registeredOn	number
scanAbortedOn	number
scanFinishedOn	number
scanStartedOn	number
scanStatus	string
siteId	string
siteName	string
totalMemory	number
updatedAt	number	Please use updatedOn instead	deprecated: true
uuid	string

---