SentinelOne

Release 2.0

About This Document

This guide details the steps necessary to connect SentinelOne to the Epiphany Intelligence Platform. The Epiphany Intelligence Platform leverages data from tools like SentinelOne to provide greater visibility into the risks in your environment.

SentinelOne allows API access by virtue of an API key, which can be created in the management console by an individual user. The permissions granted to the API key will be limited to those of the user associated to that key.

Overview

The Epiphany Intelligence Platform only requires viewer access to SentinelOne, which is one of the default roles within the system.

There are two options to accomplish this; either method is acceptable:

• Option 1: Create a new user, who is designated for use by Epiphany, and generate an API key.

• Option 2: Leverage an existing user and generate an API key.

Version Compatibility

• Epiphany : Epiphany Collector Version 1.o and later.

• SentinelOne API: SentinelOne API Version 2.1.

Prerequisites

• Access to the SentinelOne management console.

• Ability to create a user, or access to an existing user with the viewer role.

Epiphany only requires viewer access to SentinelOne, which is one of the default roles within the system.

What is Needed for Integration

• The username from which the API key is created.

• The URL of the SentinelOne appliance.

• The API key itself.

Legal Notice