SentinelOne

Purpose

The SentinelOne connector reads agent health, threat and application inventory data through the SentinelOne Management Console API using a read-only service user, feeding endpoint detection and vulnerability controls.

Requirements

• A SentinelOne Management Console with API access enabled
• A service user assigned the Viewer role scoped to the relevant sites or groups
• Outbound HTTPS from the AssurIQ Cloud Connector to the management console URL

Permissions

• Viewer role — read agent inventory, health and configuration
• Read access to Threats/Incidents for detection evidence
• Read access to Application Inventory, where the module is licensed

Setup

1. 1
   Create a service user

   In the Management Console, create a dedicated user and assign the Viewer role at the appropriate scope.
2. 2
   Generate an API token

   Generate an API token for that user from their profile settings.
3. 3
   Add the console to AssurIQ

   In Integrations, add the console URL and API token, stored in the Credential Vault.
4. 4
   Select scope

   Restrict collection to the sites or groups relevant to the connected AssurIQ customer.
5. 5
   Verify collection

   Confirm agent inventory and threats populate under Vulnerability Center.

Verification

• SentinelOne-protected endpoints appear with agent version and health
• Threats and incidents populate alongside other detections
• Application inventory populates where licensed

Data collected

• Agent inventory, version and health status
• Threats and incidents with severity and status
• Application inventory per endpoint, where licensed
• Policy and site assignment metadata

Security model

The Viewer role cannot mitigate threats, isolate endpoints or change policy; it is strictly read-only. The API token is scoped to that role and stored encrypted, used only over the console's TLS endpoint.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.

Troubleshooting

• If only some endpoints appear, confirm the Viewer user's scope includes every relevant site or group.
• If detections seem delayed, allow one collection cycle for the console's own data to settle after an event.

Disconnect

1. Disconnect SentinelOne from AssurIQ Integrations.
2. Delete or disable the Viewer service user and its API token in the Management Console.