SentinelOne Management Console Integration
It would be great if there were a full-featured SentinelOne integration via an API (just like the Unifi integration). Using the API, we could query customers in the S1 console and then map them to customers in Octoja. It’s not possible to build suitable checks using the S1 logs on the client or via Sentinelclt.exe. The following checks would be important for the integration:
- PCs with an open alert (alert details)
- Alert instances
- Whether the alert has been mitigated
- Whether the alert has been resolved
- Whether the PC is isolated
- The PC's policy and network status
Log in to comment and vote
No comments yet
Be the first to share your thoughts.