Knowledge BaseRelease NotesRequest Demo

SentinelOne Logs

Connecting SentinelOne Cloud Funnel logs to your Panther Console

Overview

Panther supports the following log types from SentinelOne:

How to onboard SentinelOne API Activity logs to Panther

The instructions below apply to SentinelOne API Activity logs. For instructions on how to onboard SentinelOne Cloud Funnel logs, see the next section: How to onboard SentinelOne Deep Visibility logs to Panther.

Panther's support for SentinelOne API Activity logs is currently in open beta. Please share any bug reports and feature requests with your Panther support team.

Prerequisites

  • You will need an API Token from a Service User that has the Viewer role in your SentinelOne account.

Create a SentinelOne Service User + API Token

  1. Log in to your SentinelOne Dashboard.

  2. In the left sidebar menu, click Settings.

  3. At the top of the Settings page, click the Users tab.

    In SentinelOne, the Settings icon is highlighted in the left sidebar menu and the "Users" tab is circled at the top.

  4. On the left side of the Users page, click Service Users.

  5. Click the Actions dropdown, then click Create New Service User.

    On the Settings page, "Service Users" is highlighted on the left. The Actions dropdown menu is expanded, and the "Create New Service User" option is highlighted.

  6. On the "Create New Service User" page, enter a name and a description, choose an expiration date, then click Next. The "Create a new service user" page has fields for Name and Description, and a dropdown menu to choose an expiration date.

  7. On the "Select Scope of Access" page, configure the following:

    • Access Level: Account

    • Account selected: Ensure you have selected the correct account and that the role is set to Viewer.

  8. Click Create User.

  9. Copy the API Token and store it in a secure location, as you will need to provide to Panther in the next part of the log source onboarding process.

Create a new SentinelOne API source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for “SentinelOne API,” then click its tile.

  4. Click Create New.

  5. In the slide-out panel, click Start Setup.

  6. Configure the SentinelOne API source:

    • Name: Enter a descriptive name for the source, e.g., SentinelOne API

    • SentinelOne API Organization: Enter the subdomain of your SentinelOne account. To find this value, log in to your SentinelOne Dashboard and copy the subdomain from the URL.

      • For example, if your dashboard URL is https://example-domain.sentinelone.net/dashboard, your subdomain would be example-domain.

    • API Token: Enter the token of your Service User that you copied in the previous steps of this documentation.

      On the Configuration page of the SentinelOne API source setup flow, there are fields for Name, SentinelOne API organization, and API Token.

  7. Click Setup. You will be directed to a success screen:

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

How to onboard SentinelOne Cloud Funnel Deep Visibility logs to Panther

  1. Set up your Data Transport in the Panther Console.

  2. Configure SentinelOne to push logs to the Data Transport source.

Supported log types

Required fields in the schema are listed as "required: true" just below the "name" field.

SentinelOne.Activity

Activity events from the SentinelOne API.

SentinelOne.DeepVisibility2

Deep Visibility 2.0 events from the SentinelOne services.

PreviousSalesforce LogsNextSlack Logs

Last updated

Was this helpful?