SentinelOne
The Dropzone AI Platform integrates with SentinelOne, an endpoint cybersecurity platform that protects against various types of threats. Integrating SentinelOne with Dropzone allows Dropzone to automatically investigate security incidents in your SentinelOne environment.
Create a Service User and API Key
SentinelOne requires an API key from a Service User with Viewer Access to enable.
To obtain an API Key, do the following:
Log in to the SentinelOne Management Console
In the left navigation bar of the SentinelOne dashboard, click "Settings"

Navigate to Users > Service Users
Click the Actions dropdown, then click "Create New Service User"

Enter the Name, Description, and Expiration Date, then click "Next"

Under Access Level, select "Account." Select the newly generated account and set the role to Viewer

Click "Create User"
Copy the API Token shown for use later in the Dropzone UI where it is called "API Token"

Enable the Dropzone Data Source Integration
To enable the Data Source integration, you'll need the following information:
SentinelOne Hostname
Your SentinelOne Hostname, e.g. usea1-123.sentinelone.net
API Token
The API token value you copied earlier
SentinelOne XDR Hostname
Your Singularity Data Lake Console hostname, e.g. xdr.us1.sentinelone.net
To enable the Data Source integration, do the following:
Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
In the bottom left hand corner, click Settings > Integrations

Click "Available"

In the Search bar, search SentinelOne, then click "Configure"

Under the Data Source header, input your SentinelOne hostname and API Token
To allow Dropzone to use the XDR API, check the box labeled "Enable XDR API," then input your hostname for the Singularity Data Lake Console
Enabling the XDR API is optional, but provides crucial investigation data.

Click "Test & Save"
Enable the Dropzone Alert Source Integration
In addition to data source integration, Dropzone can be configured to monitor and investigate specific incident types from SentinelOne.
SentinelOne Hostname
Your SentinelOne Hostname, e.g. usea1-123.sentinelone.net
API Token
The API token value you copied earlier
To enable the Alert Source integration, do the following:
Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
In the bottom left hand corner, click Settings > Integrations

Click "Available"

In the Search bar, search SentinelOne, then click "Configure"

Under the Alert Source header, input your SentinelOne hostname and API Token

If you wish to treat each of your sites in SentinelOne as separate tenants, check the box labeled "Multi-tenant environment" and click "Add Item." Then input the site IDs for each of the sites you wish Dropzone to be able to analyze

Under "Incident types," check the incident types you want Dropzone to investigate alerts for
Under "Incident status," check the incident statuses you want Dropzone to investigate alerts for
Under "Log Ingestion delay," input your desired log ingestion delay in minutes

If you wish, you may exclude threats from investigation by threat name regex. To do so, click "Add Item" in the "Threat Name Regexes" section and input your exclusions

Input your desired poll interval and lookback

Click "Test & Save" to finish
If you have any errors or questions, engage your Dropzone AI support representative.
Last updated
Was this helpful?