SentinelOne
Purpose
Imports SentinelOne endpoint security data (accounts, agents, applications, and findings) so endpoint telemetry can be correlated with cloud and identity data.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
sentinelone_api_url |
No | SentinelOne management API base URL |
sentinelone_api_token |
Yes | SentinelOne API token |
sentinelone_account_ids |
No | Account IDs to scope the sync (leave empty for all) |
Setup Steps
- In SentinelOne, open Settings → User Management → Service Users. Older consoles label this menu Settings → Users → Service Users.
- Actions → Create New Service User. Enter a name and expiration date; click Next.
- Choose the site or account the service user should access, assign the Viewer role, and click Create.
- Copy the API token — SentinelOne only displays it once.
- Note your API base URL (e.g.
https://usea1-partners.sentinelone.net). - In SubImage, fill in:
sentinelone_api_url— the API base URLsentinelone_api_token— the token (or its AWS Secret ARN)sentinelone_account_ids— optional; one account ID per entry
- Save the module and run a manual sync to validate.
Notes
- The sync is read-only. SentinelOne's default Viewer role is sufficient; the service user does not need Admin.
- Service users cannot sign in to the console. They exist only to hold API tokens.
- API tokens cannot be refreshed. When one expires, create a new service user and update
sentinelone_api_token.