SentinelOne
Proofroom reads SentinelOne with a service user’s API token. Add it on Integrations → Catalogue → SentinelOne → Connect.
What each collector shows
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| Anti-malware coverage | snapshot | monthly | Every agent that is not decommissioned or uninstalled, with its policy mode (protect blocks; detect only reports), SentinelOne’s own up-to-date reading, network status, infection flag and last activity. An agent whose operational state is disabled is off. Each agent’s problems are listed: detect only, protection off, not seen for 7 days (or the number you set), out of date; agents whose currency the vendor does not report are counted as currency unknown, not as current. | PCI DSS 5.2.1, 5.2.2, 5.3.1; SOC 2 CC6.8 |
| Endpoint alerts and response | window | monthly | Threats raised in the window, and malicious threats raised earlier that are not resolved. SentinelOne threats have no severity: malicious is shown as high and suspicious as medium. A resolved threat’s resolved time is its last update. Counts by severity, median days to resolve, and every high or critical alert still open with its age. | PCI DSS 12.10.5; SOC 2 CC7.2, CC7.3 |
The agent list feeds the Endpoint coverage built-in, which compares it with your device manager’s inventory, and the Endpoints posture score.
Create the service user
- In the management console, go to Settings → Users → Service Users → Actions → Create New Service User.
- Name it “Proofroom”, set an expiry date, and give it the Viewer role at the account (or site) scope, or a custom role with only Endpoints view and Threats view.
- Copy the API token; it is shown once.
Service-user tokens expire on the date you set. Proofroom reads the date from SentinelOne (UNVERIFIED endpoint; when it cannot, the integration page says so) and warns before it. Generate a new token before then (Actions → Generate API token, which revokes the old one), then paste it into the connection.
Connect
| Field | Value |
|---|---|
| Console address | Such as https://acme.sentinelone.net |
| API token | From step 3 |
staleDays |
7 by default |
Test connection counts agents and reads one threat. An expired token is named as such.
Known limits
- UNVERIFIED: that the predefined Viewer role holds Endpoints view and Threats view (no public permission list).
- UNVERIFIED: SentinelOne’s rate limits. A 429 is waited out.