SentinelOne

Endpoint Protection

Overview

The SentinelOne connector integrates with the SentinelOne Singularity platform to synchronize endpoint security data into Brinqa. It collects managed devices (agents), installed applications, detected threats, and vulnerability findings, enabling continuous risk visibility across your endpoint estate.

---

Data retrieved from SentinelOne

Connector Object	Required	Maps to Data Model
Device	Yes	Host
Application	Yes	Package
Application Install	Yes	Installed Package
Threat	Yes	Incident
Threat Definition	Yes	Incident Definition
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from SentinelOne in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select SentinelOne from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	https://<tenant>.sentinelone.com	SentinelOne server URL
API token	Yes	—	SentinelOne API token
Page size	No	1000	Maximum number of records to get per API request
Maximum retries	No	10	The maximum number of retry attempts before giving up a request
SSL / TLS	No	false	Skip certificate verification

Authentication

SentinelOne uses a static API token passed in the Authorization header of every request.

Endpoint

Method	URL
N/A — token is provisioned in the SentinelOne console	https://<tenant>.sentinelone.net/

Request Headers

Header	Value
Authorization	ApiToken <your-api-token>
Accept	application/json

Connectivity Test

On configuration, the connector validates the token by issuing a minimal request:

GET /web/api/v2.1/agents?skip=0&limit=1
Authorization: ApiToken <your-api-token>
Accept: application/json

Sample Response

{
  "pagination": {
    "totalItems": 1,
    "nextCursor": null
  },
  "data": [
    {
      "id": "930561763530188959",
      "uuid": "84099bea98d64f14af5c84d162504a35",
      "computerName": "sentinelone-win-1"
    }
  ]
}

A 2xx response confirms the token is valid; a 4xx response (parsed by the connector's error handler) indicates an invalid token or insufficient permissions.

Usage

Every API call includes the token directly in the request header — there is no token exchange or expiry flow:

Authorization: ApiToken <your-api-token>

The token is provisioned in the SentinelOne management console under Settings → Users → Service Users.

---

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain SentinelOne credentials

Generate a SentinelOne API token

For the SentinelOne connector to use the SentinelOne API, you must provide an API token from SentinelOne. SentinelOne does not allow retrieving the API token for an existing user. To generate a new API token, follow these steps:

1. Log in to your organization's SentinelOne server as an administrator.

2. Navigate to Settings > Users.

3. Select the user for which you want to generate a new API token.

4. Next to API Token, click Generate.

   Your new API token displays. You can not view the token again after this. Copy and save it to a secure location.

Note: If you do not have the permissions to create a SentinelOne API token, contact your SentinelOne administrator. Consult SentinelOne documentation for accuracy.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Device

Source Field Name	SDM Attribute
agent.accountId	ACCOUNT_ID
agent.accountName	ACCOUNT_NAME
agent.activeDirectory.computerDistinguishedName	COMPUTER_DN
agent.activeDirectory.computerMemberOf	COMPUTER_MEMBER_OF
agent.activeDirectory.lastUserDistinguishedName	LAST_USER_DN
agent.activeDirectory.lastUserMemberOf	LAST_USER_MEMBER_OF
agent.activeThreats	ACTIVE_THREATS
agent.agentVersion	AGENT_VERSION
agent.allowRemoteShell	ALLOW_REMOTE_SHELL
agent.appsVulnerabilityStatus	VULNERABILITY_STATUS
agent.cloudProviders.*.cloudInstanceId	INSTANCE_ID
agent.computerName	NAME
agent.computerName	DNS_NAMES
agent.computerName	HOSTNAMES
agent.computerName	PRIVATE_DNS_NAMES
agent.consoleMigrationStatus	CONSOLE_MITIGATION_STATUS
agent.coreCount	CORE_COUNT
agent.cpuCount	CPU_COUNT
agent.cpuId	CPU_ID
agent.createdAt	SOURCE_CREATED_DATE
agent.detectionState	DETECTION_STATE
agent.domain	DOMAIN
agent.encryptedApplications	ENCRYPTED_APPLICATIONS
agent.externalId	EXTERNAL_ID
agent.externalIp	PUBLIC_IP_ADDRESSES
agent.firewallEnabled	FIREWALL_ENABLED
agent.groupId	GROUP_ID
agent.groupName	GROUP_NAME
agent.id	UID
agent.id	AGENT_ID
agent.infected	INFECTED
agent.inRemoteShellSession	IN_REMOTE_SHELL_SESSION
agent.installerType	INSTALLER_TYPE
agent.isActive	IS_ACTIVE
agent.isDecommissioned	STATUS
agent.isDecommissioned	IS_DECOMMISSIONED
agent.isPendingUninstall	IS_PENDING_UNINSTALL
agent.isUninstalled	IS_UNINSTALLED
agent.isUpToDate	IS_UPTO_DATE
agent.lastActiveDate	LAST_SEEN
agent.lastActiveDate	LAST_ACTIVE
agent.lastIpToMgmt, agent.externalIp, agent.networkInterfaces.inet	IP_ADDRESSES
agent.lastIpToMgmt, agent.networkInterfaces.inet	PRIVATE_IP_ADDRESSES
agent.lastLoggedInUserName	LAST_LOGGED_IN_USERNAME
agent.lastSuccessfulScanDate	LAST_SUCCESSFUL_FULL_SCAN
agent.locations.name	LOCATIONS
agent.locationType	LOCATION_TYPE
agent.machineSid	MACHINE_SID
agent.machineType	CATEGORIES
agent.machineType	MACHINE_TYPE
agent.mitigationMode	MITIGATION_MODE
agent.mitigationModeSuspicious	MITIGATION_MODE_SUSPICIOUS
agent.modelName	MODEL
agent.networkInterfaces.physical	MAC_ADDRESSES
agent.networkStatus	NETWORK_STATUS
agent.operationalState	OPERATIONAL_STATE
agent.osArch	OS_ARCH
agent.osName	OS_NAME
agent.osRevision	OS_REVISION
agent.osStartTime	LAST_STARTED
agent.osStartTime	OS_START_TIME
agent.osType	OS_TYPE
agent.osType, agent.osRevision, agent.osArch	DESCRIPTION
agent.osType, agent.osRevision, agent.osArch	OPERATING_SYSTEM
agent.osUsername	OS_USERNAME
agent.rangerStatus	RANGER_STATUS
agent.rangerVersion	RANGER_VERSION
agent.registeredAt	FIRST_SEEN
agent.registeredAt	REGISTERED_AT
agent.scanAbortedAt	SCAN_ABORTED_AT
agent.scanFinishedAt	SCAN_FINISHED_AT
agent.scanStartedAt	SCAN_STARTED_AT
agent.scanStatus	SCAN_STATUS
agent.serialNumber	SERIAL_NUMBER
agent.siteId	SITE_ID
agent.siteName	SITE_NAME
agent.threatRebootRequired	THREAT_REBOOT_REQUIRED
agent.totalMemory	TOTAL_MEMORY
agent.updatedAt	SOURCE_LAST_MODIFIED
agent.userActionsNeeded	USER_ACTION_NEEDED
agent.uuid	AGENT_UUID

Application

Source Field Name	SDM Attribute
app.name	NAME
app.osType	OS type
app.publisher	Publisher
app.signed	Signed
app.size	Size
app.type	CATEGORIES
app.type	Kind
app.version	Revision
MD5(publisher:name:version)	UID

Application Install

Source Field Name	SDM Attribute
app.agentComputerName	Agent name
app.agentId	TARGETS
app.agentId	Agent ID
app.createdAt	Source created date
app.id	UID
app.installedAt	Installed date
app.riskLevel	Risk
app.uid	TYPE
app.updatedAt	Source last modified

Threat

Source Field Name	SDM Attribute
threat.agentRealtimeInfo.agentUuid → resolved to agent ID	TARGETS
threat.id	UID
threat.threatInfo.createdAt	FIRST_FOUND
threat.threatInfo.filePath	PATH
threat.threatInfo.fileSize	FILE_SIZE
threat.threatInfo.incidentStatusDescription	SOURCE_STATUS
threat.threatInfo.incidentStatusDescription	STATUS
threat.threatInfo.incidentStatusDescription	STATUS_CATEGORY
threat.threatInfo.mitigationStatusDescription	MITIGATION_STATUS
threat.threatInfo.threatName	TYPE
threat.threatInfo.updatedAt	LAST_FOUND

Threat Definition

Source Field Name	SDM Attribute
threat.threatInfo.classification	CATEGORIES
threat.threatInfo.confidenceLevel	CONFIDENCE_LEVEL
threat.threatInfo.threatName	UID
threat.threatInfo.threatName	NAME

Vulnerability

Source Field Name	SDM Attribute
MD5(vendor:name:version) + vulnerability.endpointId	TARGETS
vulnerability.cveId	TYPE
vulnerability.daysDetected	DAYS_DETECTED
vulnerability.detectionDate	FIRST_FOUND
vulnerability.endpointType	MACHINE_TYPE
vulnerability.id	UID
vulnerability.lastScanDate	LAST_FOUND
vulnerability.lastScanResult	LAST_SCAN_RESULT
vulnerability.markedBy	MARKED_BY
vulnerability.markedDate	MARKED_DATE
vulnerability.markType	MARK_TYPE
vulnerability.reason	REASON
vulnerability.status	PROVIDER_STATUS
vulnerability.status	SOURCE_STATUS
vulnerability.status	STATUS
vulnerability.status	STATUS_CATEGORY

Vulnerability Definition

Source Field Name	SDM Attribute
vulnerability.baseScore	CVSS_V3_BASE_SCORE
vulnerability.cveId	UID
vulnerability.cveId	NAME
vulnerability.cveId	CVE_IDS
vulnerability.cveId	CVE_RECORDS
vulnerability.publishedDate	PUBLISHED_DATE
vulnerability.severity	SEVERITY
vulnerability.severity	SEVERITY_SCORE
vulnerability.severity	SOURCE_SEVERITY

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Device

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastActiveDate.

API

• Type: REST · Endpoint: GET /web/api/v2.1/agents
• Default filters: lastActiveDate__gte (applied only when an incremental since is provided)

Application

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on installedAt.

API

• Type: REST · Endpoint: GET /web/api/v2.1/installed-applications
• Default filters: installedAt__between (applied only when an incremental since is provided)

Application Install

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on installedAt.

API

• Type: REST · Endpoint: GET /web/api/v2.1/installed-applications
• Default filters: installedAt__between (applied only when an incremental since is provided)

Threat

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Threat on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /web/api/v2.1/threats
• Default filters: None applied directly to the threats endpoint

Threat Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Threat Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /web/api/v2.1/threats
• Default filters: None applied directly to the threats endpoint

Vulnerability

Operation options

Option	Type	Default	Description
endpointTypes	String (comma-separated)	—	SentinelOne's native device-type filter on the risks endpoint (for example desktop,laptop,server). When set, only vulnerabilities for the selected endpoint machine types are synced, reducing the data pulled from SentinelOne. Multiple values are combined into a single comma-separated filter.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on riskUpdatedDate.

API

• Type: REST · Endpoint: GET /web/api/v2.1/application-management/risks
• Default filters: includeRemovals=true (always); riskUpdatedDate__gte (applied only when an incremental since is provided)

Vulnerability Definition

Operation options

Option	Type	Default	Description
endpointTypes	String (comma-separated)	—	SentinelOne's native device-type filter on the risks endpoint (for example desktop,laptop,server). When set, only CVE definitions for the selected endpoint machine types are synced, reducing the data pulled from SentinelOne. Multiple values are combined into a single comma-separated filter.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on riskUpdatedDate.

API

• Type: REST · Endpoint: GET /web/api/v2.1/application-management/risks
• Default filters: includeRemovals=true (always); riskUpdatedDate__gte (applied only when an incremental since is provided)

Changelog

Changelog

The SentinelOne connector has undergone the following changes:

Version	Description	Migration Steps
3.2.8	Improvements Device Type Filtering for Vulnerability Sync - Vulnerability synchronization can now be restricted to specific device machine types by configuring an endpointTypes filter (for example desktop,laptop) — SentinelOne's native device-type filter on the risks endpoint. When set, only vulnerabilities for the selected device types are imported, reducing the amount of data pulled from SentinelOne. Filters that accept multiple selected values are combined and applied correctly. Machine Type on Vulnerability - Vulnerability records now include a Machine type attribute identifying the affected endpoint's device type (server, desktop, laptop, etc.).	• Vulnerability: Re-sync Vulnerability records after upgrading to populate the new Machine type attribute.
3.2.7	Bug Fixes Application Install Date/Time Attributes - Fixed the Application Install model where Created at, Installed date, and Updated at were stored as integer values instead of date/time. These fields now correctly reflect the timestamps returned by the SentinelOne API.	• Application Install: The Created at attribute has been renamed to Source created date and Updated at has been renamed to Source last modified to align with standard platform attributes. The Installed date attribute type has changed from integer to date/time. A full re-sync of Application Install records is required after upgrading to apply the updated attribute names and types.
3.2.6	Improvements Dependency Upgrades - Upgraded internal framework and storage libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.2.5	Bug Fixes Device Status - Corrected the Device status mapping so that decommissioned endpoints are now reported as inactive and active endpoints as active. Previously these values were inverted, which could mislabel a device's operational status.	N/A
3.2.4	Improvements Containerized Workload Visibility - Device records now include container workload counts, giving better visibility into endpoints running containerized workloads. Bug Fixes Device Serialization - Resolved a serialization issue that could prevent certain Device records from syncing reliably.	N/A
3.2.3	Improvements Device Operational State and Decommissioned Devices - Added an Operational state attribute to Device records. - The connector now retrieves both active and decommissioned endpoints and uses the decommissioned flag to determine device status, so that retired endpoints are reflected accurately.	N/A
3.2.2	Improvements Vulnerability Removals - Vulnerability syncs now always include removed vulnerabilities, ensuring that findings resolved or no longer present in SentinelOne are reflected and aged out correctly.	N/A
3.2.1	Improvements Additional Device Attributes - Device records now include additional details such as Active Directory and location information. Vulnerability Sync Accuracy - Vulnerability syncs now filter by risk-updated date and include removed vulnerabilities during incremental syncs, so that resolved findings are aged out correctly and updates are captured more reliably.	N/A
3.2.0	Bug Fixes Vulnerability Definition CVSS Score Type - Fixed the CVSS V3 Base Score attribute on Vulnerability Definition so that it is stored as a numeric value instead of text, enabling correct numeric filtering, sorting, and scoring.	• Vulnerability Definition: The CVSS V3 Base Score attribute type has changed from text to a decimal number. A full re-sync of Vulnerability Definition records is required after upgrading so the score is stored with the correct data type.
3.1.18	Improvements Device and Vulnerability Lifecycle - Device records now age out automatically when an endpoint has not been seen for several days, and Vulnerability findings follow the lifecycle of their associated device. - Added a Provider status attribute to Vulnerability records to preserve the original status reported by SentinelOne alongside the normalized status.	N/A
3.1.17	New Features Threat and Vulnerability Models - Added support for syncing Threat and Threat Definition records, surfacing SentinelOne threat detections as incidents. - Added support for syncing Vulnerability and Vulnerability Definition records, bringing SentinelOne application vulnerability data into the platform.	N/A
3.1.16	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.1.15	Improvements Hostname Normalization and DNS Names - Device hostnames are now normalized and stored in lowercase, and DNS names and Private DNS names are now captured for each Device. This improves correlation and matching of endpoints across data sources.	• Device: Hostnames are now normalized to lowercase and additional DNS name attributes are populated. A full re-sync of Device records is required after upgrading to apply the normalized values.
3.1.14	New Features Configurable Retry Limit - Added a Maximum retries configuration option, letting you control how many times the connector retries a request before giving up. This improves resilience against transient API errors and rate limiting. Bug Fixes Application Filtering - Predefined applications are no longer incorrectly excluded during filtering, so the full set of installed applications is captured.	N/A
3.0.13	Improvements Application Type Attribute - Renamed the Application type attribute from Type to Kind to avoid conflicting with a reserved platform attribute name.	• Application: The Type attribute has been renamed to Kind. A full re-sync of Application records is required after upgrading to apply the renamed attribute.
3.0.12	Improvements Identifier Mapping - Standardized how Device, Application, and Application Install records are identified by adding the source UID as an explicit identifier. This makes record matching and correlation more consistent.	• Device, Application, Application Install: The identifier configuration for these models has changed. A full re-sync of these records is required after upgrading so they are re-keyed correctly.
3.0.11	Improvements Asset Categories - Device and Application records now populate the standard Categories attribute (replacing the prior single Category value), aligning these endpoints and applications with the platform's standard asset categorization.	• Device, Application: The single Category attribute has been replaced by the multi-valued Categories attribute. A full re-sync of these records is required after upgrading to apply the updated attribute and values.
3.0.10	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.9	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.8	Improvements Network Address Collection - Device records now collect private IP addresses and MAC addresses from all network interfaces into the multi-valued Private IP addresses, IP addresses, and MAC addresses attributes, replacing the prior single-value IP and MAC attributes. Loopback and placeholder addresses are excluded.	• Device: The single-value IP and MAC address attributes have been replaced by multi-valued private IP, IP, and MAC address attributes. A full re-sync of Device records is required after upgrading to apply the updated attributes.
3.0.7	Improvements Cloud Endpoint Metadata - Device records now capture cloud instance identifiers for AWS, Azure, and GCP endpoints, along with Source created date, Source last modified, and Last started timestamps. The set of attributes used to match devices was also refined to improve correlation of cloud endpoints.	• Device: The attributes used to identify and match devices have changed (cloud instance ID was added and the address-based matching was refined). A full re-sync of Device records is required after upgrading so devices are re-keyed correctly.
3.0.6	Improvements First Seen Date - Device records now include a First seen date reflecting when the endpoint was first registered with SentinelOne.	N/A
3.0.5	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.4	Improvements Device Hostname and Timestamps - Device records now populate a dedicated Hostname attribute and store the Last seen and Created at timestamps as proper date/time values rather than raw numbers. The set of attributes used to match devices was also refined to use hostname instead of name.	• Device: The Last seen and Created at attributes are now stored as date/time values, and the device matching attributes changed. A full re-sync of Device records is required after upgrading to apply the updated attribute types and identifiers.
3.0.3	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.2	Improvements Connector Icon - Updated the connector to use the official SentinelOne icon.	N/A
3.0.1	Bug Fixes Device Status - Fixed Device status reporting so that inactive endpoints are correctly marked as inactive.	N/A
3.0.0	Overview The SentinelOne connector integrates with SentinelOne to synchronize endpoint devices and the applications installed on them. Category: Endpoint Protection Models	N/A