Skip to main content

SentinelOne Management Console Integration

It would be great if there were a full-featured SentinelOne integration via an API (just like the Unifi integration). Using the API, we could query customers in the S1 console and then map them to customers in Octoja. It’s not possible to build suitable checks using the S1 logs on the client or via Sentinelclt.exe. The following checks would be important for the integration:
- PCs with an open alert (alert details)
- Alert instances
- Whether the alert has been mitigated
- Whether the alert has been resolved
- Whether the PC is isolated
- The PC's policy and network status

Log in to comment and vote

No comments yet

Be the first to share your thoughts.