Get API URL.
Open the SentinelOne console in your browser.
Copy the base URL of your SentinelOne console from the browser's address bar. It should be in the following format:
https://<your-console>.sentinelone.netDo not include any path or a trailing
/.
Create an API Key in your SentinelOne.
Set up the required permissions
To generate an API key, your user must have a role that includes the permissions listed below.
In the SentinelOne console, go to Policies and settings > Roles.
To create a new role, click New Role, to update an existing role, click the role in the list.
In the role modal, make sure the following permissions are assigned. Some may already be enabled, so you only need to assign the ones that are missing:
Sites: View (enabled by default)
Accounts: View (enabled by default)
SDL Search: View, Edit, Create, Delete
LOG Collection Rules: View, Edit, Create, Delete, Activate
Console Users: View
Save the changes.
Generate the API token
In the SentinelOne console, go to Policies and settings > Console users.
Find your user in the list and click it. A modal with the user details opens.
In the modal, click Actions > API token operations > Generate API token.
Tip: Before generating the token, click Show permissions in the Roles section to check that your user has all the permissions. You can add any missing ones in Policies and settings > Roles.
When the token is generated, copy it by clicking Copy API Token. The token cannot be retrieved or viewed again after you close this window. If it is lost, you will need to generate a new one.
Get the Site IDs.
SentinelOne organizes data in a hierarchy of containers: Tenant (the whole SentinelOne console) > Account > Site. A Site is a container within an Account. The Site ID identifies a specific Site and defines the scope in which the Data Plane runs API requests. At least one Site ID is required.
To get Site IDs:
In the SentinelOne console, click Open scope panel.
Find the required Site in the list.
Click the three dots next to that Site and select Copy site ID. Repeat for each Site you want to include.
Get the Account IDs (Optional).
An Account is a container within the Tenant that holds one or more Sites. The Account ID identifies a specific Account and defines the scope in which the Data Plane runs API requests at the Account level.
To get Account IDs:
In the SentinelOne console, click Open scope panel.
Find the required Account in the list.
Click the three dots next to that Account and select Copy account ID. Repeat for each Account you want to include.
Configure a SentinelOne Data Plane on the SOC Prime Platform.
Create a new Data Plane and select SentinelOne as the Platform.
In API URL, enter the address from Step 1.
In API Key, enter the token from Step 2.
In Site IDs, enter the IDs from Step 3.
(Optional) In Account IDs, enter the IDs from Step 4.
How to Get Credentials for SentinelOne Data Plane
N
Written by Nataliia Pukaliak