To interact with the SentinelOne XDR API, collect the Base URL of the service. The Base URL is the URL you use to manage your SentinelOne XDR deployment.
The Base URL has the format `https://<host>.sentinelone.net`. The host string is specific for each SentinelOne deployment.
You need to identify the operational scope you want the integration to operate with. The scope could be defined at Account, Group or Site level. You can check this information through the SentinelOne Web console.
We recommend creating a role with the minimum privileges required for the integration to work properly.To create this role, go to the Settings > Users > Roles within your SentinelOne console.
Page | Permission |
Accounts | View |
Sites | View |
Groups | View |
Blocklist | ViewEditDeleteCreate |
The following images show how to configure the required permissions. Remember to save your configuration by clicking on the Save button.
To interact with the SentinelOne REST API, you need to create a Service User. To do so, go to the Settings > Users > Service Users menu within your SentinelOne Console.
Copy the API Token, it will be required later to set up the integration.
1. Log in to your Lumu account through the Lumu Portal and navigate to the integrations screen.
2. Locate the SentinelOne integration in the available apps area and click to add, then click to view details.
3. Familiarize yourself with the integration details available in the app description and click the button below to activate the integration.
4. To activate the integration, add a Name and select the Threat Types you want to be pushed to your SentinelOne deployment. Click Next.
5. Fill in the required information, the Base URL and the API Token with the data collected before. Click Next.
6. Lumu will retrieve for you the SentinelOne operational scope alternatives. Specify the scope this integration will apply to. It can be any of SentinelOne accounts, sites, or groups. Click Activate.
The integration is now created and active. Now, the Lumu Portal will display the details of the created integration: