---
title: "SentinelOne"
slug: "sentinel-one"
updated: 2025-03-20T19:52:10Z
published: 2025-03-20T19:52:10Z
canonical: "docs.databee.buzz/sentinel-one"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

SentinelOne delivers comprehensive endpoint protection by integrating prevention, detection, and response, ensuring robust defense against diverse cyber threats.

More information can be found at [SentinelOne](https://www.sentinelone.com/home/).

**Integration Method**: API

**Tables**: Detection Finding (2004), Device Config State (5002)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Agents | Retrieves agents and their associated data. |
| Threats | Retrieves a list of threats. |

This integration supports the following versions.

| SentinelOne API version | v2.0 |
| --- | --- |

> [!NOTE]
> **Note:**
> 
> SentinelOne is a continuously updated cloud service. As of this document preparation, the latest release was S-25.1.1.61.

## Prerequisites

- The user should have access to the SentinelOne platform to generate API clients.
- The user should have access to the DataBee console.

## Configuration Overview

1. Generate client credentials with the required scopes.
2. Add the [SentinelOne data feed](/user-manual/docs/sentinelone#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **SentinelOne Parameter** |
| --- | --- |
| Token | API Token |
| API Base URL<instance> | Replace <instance> with the Management URL provided in the invitee’s email. It's in this format: https://<your_management_url> |

## SentinelOne Configuration

Before you start configuring data feed on Databee UI, you will need to create the API Client and get the necessary information for API authentication such as Client ID and Client Secret. To generate API Client, follow these steps:

1. Logon to **SentinelOne** Platform.
2. Click your **username** from the top right corner > Select **My User**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-qkw3q641.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)
3. Click on **Actions** > **API Token Operations** > **Generate API Token**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-5fr7oktw.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)

> [!NOTE]
> Note:
> 
> If the token has already been generated, the option to Regenerate API Token will be displayed.
4. Copy the generated **API Token**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-24ucx1v0.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)

> [!NOTE]
> Note:
> 
> The user needs to re-create the client secret every 30 days once it expires and reconfigure the data feed in DataBee console. Additionally, once this step is completed, the user will not be able to view the API credentials again. Ensure the keys are stored in a secure location before proceeding.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-5jiokmzx.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)
2. Search for the **SentinelOne** and click it as shown below**.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-zangc4rv.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)
3. Click on the **API Ingest** option for the collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-e7gvpiui.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-fbzysle8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)
5. In the configuration page, confirm the following:
  - Authorization Method: Bearer Token
  - API Base URL: replace the placeholder with your instance details. For example: [SentinelOne](https://myinstancename.sentinelone.net).
  - Token: paste the API Token.
  - Event Types: preselected for all the event types that integration pulls. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/sentinelone-mar2025-image-szo2zvk1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A13Z&se=2026-10-30T13%3A20%3A13Z&sr=c&sp=r&sig=14O%2BhqE63TDY3fCK4h6RogtNIyb17YmouTJVWEN6qaA%3D)
6. Click **Submit**.

## Troubleshooting Tips

- If you’re facing **invalid_client** or **unauthorized_client** issues this might be possibly due to incorrect credentials. Ensure the token is pasted correctly. Since you cannot view the token after the 1st time, re-create the token, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.

#