SentinelOne

Pull user, agent, group info and more to connect across tools.

Overview

Use the SentinelOne integration to identify problems with your users and assets before they occur. Integrating with SentinelOne enables you to build boards that correlate fields within SentinelOne and with other connected tools. You can also run actions on fetched data without ever leaving Stitchflow.

Generate API key

1. In SentinelOne go to User > My User

2. Generate the API token, then download or copy it. This API key expires and will need to be regenerated every six months

Configure

Enable the SentinelOne integration from Connections in the left sidenav. Click Connect and enter your API key. Before connecting, SentinelOne will sync for a few minutes while fetching data. Once connected, you can click the ... menu on the SentinelOne integration tile to manage or disconnect the integration.

Manage permissions

SentinelOne actions allow you to run operations on fetched data without ever leaving Stitchflow. All actions are enabled by default and will be accessible on every board, but can be disabled by clicking the ... menu and selecting Remove connection.

Please note that disconnecting SentinelOne will also permanently delete any boards in which it is used.

Data model

We automatically fetch and relate the following objects from SentinelOne resources.

Supported objects

• Users

• Agents

• Groups

We support the following actions in SentinelOne.

Supported actions

• Create user

• Delete user

• Change user password

• Create group

• Enable agent

• Disable agent

• Create group

• Delete group

Boards

When building a board, you can select any supported SentinelOne resource as your object to indicate the data you want to surface on your board. We automatically determine the primary field for each object. The primary field is meant to be a unique representation of each record in a board.

An object in Stitchflow is a data type that is used to treat several different pieces of data as one unit.

Adding fields

Click Add field to select fields from both within SentinelOne and across your other connected tools. We only show fields that can be joined with your chosen object.

Triggering actions

Click Integration actions in the top right of any board to view all available actions across your connected integrations. When selecting an action, you'll be prompted to fill out all required inputs necessary to run the action. Changes and updates made via actions will persist to all boards.

Stitchflow fetches SentinelOne data every 24 hours.