Skip to main content


SentinelOne is an endpoint protection and threat response tool. You can bring device, application, and application install data from SentinelOne into Brinqa to construct a unified view of your attack surface and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with SentinelOne and how to obtain that information from SentinelOne. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select SentinelOne from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate SentinelOne with Brinqa:

  • Server URL: The SentinelOne Server URL.

  • API token: The API token associated with the SentinelOne account, which must have permissions to log in to the API server and return data.

Generate a SentinelOne API token

For the SentinelOne connector to use the SentinelOne API, you must provide an API token from SentinelOne. SentinelOne does not allow retrieving the API token for an existing user. To generate a new API token, follow these steps:

  1. Log in to your organization's SentinelOne server as an administrator.

  2. Navigate to Settings > Users.

  3. Select the user for which you want to generate a new API token.

  4. Next to API Token, click Generate.

    Copy the API token to a safe and secure location.


Consult SentinelOne documentation for accuracy. If you do not have the permissions to create a SentinelOne API token, contact your SentinelOne administrator.

Additional settings

The SentinelOne connector contains additional options for specific configuration:

  • Set page size: The maximum number of records to get per API request. The default setting is 1000. It is not recommended to go over 1000.

  • Skip certificate verification: Select this option to allow for untrusted certificates.

Types of data to retrieve

The SentinelOne connector can retrieve the following types of data from the SentinelOne API:

Table 1: Data retrieved from SentinelOne

Connector ObjectRequiredMaps to Data Model
Application InstallNoInstalled Package
Threat DefinitionNoIncident Definition
Vulnerability DefinitionYesVulnerability Definition

For detailed steps on how to view the data retrieved from SentinelOne in the Brinqa Platform, see How to view your data.

Operation options

The SentinelOne connector supports the following operation options. See connector operation options for information about how to apply them.

Table 2: SentinelOne connector operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
DeviceosTypeswindows, macos, or linuxA comma-separated list of operating systems. You can use this option to retrieve data from SentinelOne that only contains the specified operating system.Key: osTypes Value: linux. This key and value combination only retrieves data from SentinelOne that pertains to the Linux operating system.
machineTypesdesktop, laptop, server, storage, or kubernetes nodeA comma-separated list of machine types. You can use this option to retrieve data from SentinelOne that only contains the specified machine type.Key: machineTypes Value: desktop. This key and value combination only retrieves data from SentinelOne that pertains to desktop machines.

The option keys are case-sensitive and the possible values are in lowercase as they are shown in the documentation.


The SentinelOne connector uses the SentinelOne API. Specifically, it uses the following endpoints:

Table 3: SentinelOne API Endpoints

Connector ObjectAPI Endpoint
Application Install/web/api/v2.1/installed-applications
Threat Definitionweb/api/v2.1/threats
Vulnerability Definitionweb/api/v2.1/application-management/risks


The SentinelOne connector has undergone the following changes:


  • Added the Threat, Threat Definition, Vulnerability, and Vulnerability Definition objects.


  • Updated dependencies.


  • Fixed some sync errors.

  • Made the Application and Application Install objects optional.


  • Fixed an error when syncing the Device object.


  • Added cloud metadata as a source for the Device object.


  • Added a FIRST_SEEN attribute to the Device object.