SentinelOne
Purpose
Imports SentinelOne endpoint security data (accounts, agents, applications, and findings) so endpoint telemetry can be correlated with cloud and identity data.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
sentinelone_api_url |
No | SentinelOne management API base URL |
sentinelone_api_token |
Yes | SentinelOne API token |
sentinelone_account_ids |
No | Account IDs to scope the sync (leave empty for all) |
Setup Steps
- In SentinelOne, open Settings → Users → Service Users.
- Actions → Create New Service User. Enter a name and expiration date; click Next.
- Choose the site or account the service user should access; click Create.
- Copy the API token — SentinelOne only displays it once.
- Note your API base URL (e.g.
https://usea1-partners.sentinelone.net). - In SubImage, fill in:
sentinelone_api_url— the API base URLsentinelone_api_token— the token (or its AWS Secret ARN)sentinelone_account_ids— optional; one account ID per entry
- Save the module and run a manual sync to validate.