SentinelOne API Integration
SentinelOne API Integration is an application template in the Endpoint Management category of the Application Catalog. Its card describes it as SentinelOne EDR Activity / Theats / Alerts and Resource Dump. Installing it from the form below adds an application to Applications. Its template ID, SentinelOne, is the one listed on Application Templates.
Menu path: Applications → Install Application → SentinelOne API Integration · URL path: /v2/applications/install?template=SentinelOne
Task guide: SentinelOne EDR
Application
The two fields every install form starts with: Instance name names this installation in its URL, and Display name is shown for it on Applications and its details page.
| Field | Type | Required | Default |
|---|---|---|---|
| Instance name | Text | Yes | default |
| Display name | Text | Yes | Default |
Configuration
| Field | Type | Required | Default |
|---|---|---|---|
| Console Base URL | Text | Yes | - |
| API Token | Password | Yes | - |
| Account IDs (leave empty for all accounts) | Text area | No | - |
| Site IDs (leave empty for all sites) | Text area | No | - |
Advanced configuration
Collapsed when the form opens; click its heading to show the data lake the application writes to.
| Field | Type | Required | Default |
|---|---|---|---|
| datalake | Text | Yes | managed |
| datalake index name | Text | Yes | SentinelOne |
Install
Install Application installs SentinelOne API Integration with the values in the form; Dry run checks them first, without installing (see Dry run); Cancel returns to the catalog without installing. Every template's form shares the shape described under Install Form.