SentinelOne EDR is a comprehensive asset security solution that provides businesses with advanced real-time threat detection and response capabilities.
SentinelOne EDR automates incident response processes, thus reducing detection and response times for security incidents, and offers forensic investigation capabilities, enabling security teams to conduct in-depth investigations into security incidents.
SentinelOne EDR offers comprehensive asset security, protecting against a wide range of cyber threats, including malware, ransomware, and phishing attacks.
This connector queries the SentinelOne API to generate indicators on threats and updates from workstations and servers.
This connector allows retrieving the following information about workstations and servers separately:
Total number of assets, up-to-date assets, infected assets, and protected assets
Detected, confirmed, untreated, and unresolved threats.
Adding and configuring the connector
To add this connector, go to Catalog > Connectors > SentinelOne > Add a connector.
After adding, you need to configure:
Operator perimeter: the perimeter that operates and prescribes asset protection rules, to which indicators will be attached by default.
Frequency: the frequency at which the SentinelOne API is queried and the frequency of the metrics. This can be daily, weekly, monthly, semi-annual, or annual.
Once the connector is created, the configuration continues:
SentinelOne Namespace URL: corresponds to the URL for connecting to the SentinelOne dashboard.
SentinelOne API Key: API key generated in the SentinelOne management console (Settings > Users, select a user with the required permissions, then click Options > Generate API key).
Malware types: By default, the value is "Malware, Trojan, Virus, Infostealer", but you can add or remove categories by separating them with commas.
💡 You can also report different values across multiple perimeters using SentinelOne sites/groups: In the Consumer perimeter dropdown menu, enter group(s) or site(s) values separated by commas from two sites/groups for each desired perimeter.
⚠️ By default, API tokens created for users are only valid for 30 days, and this duration cannot be modified. Therefore, we recommend creating a dedicated Service User for Tenacy, allowing you to granularly control what TENACY accesses, what rights the associated token has, etc.
To perform this procedure, follow these steps:
Select Settings > Users > Service Users.
Select Actions > Create a new service user.
Enter a name, description, and expiration date (more convenient than 30 days).
Select Next.
Select the perimeter(s) to which the user will have access, as well as the role for each perimeter.
Select Create User.
Copy the token and paste it into the connector configuration window in TENACY.
Run your first test
Once the connector is properly configured, test the integration by running an initial execution.
Go to ⚙️ > Connectors > Click on the SentinelOne connector > Run now:
💡 Feel free to contact Tenacy support if you have any questions about this.