SentinelOne is an endpoint detection and response (EDR) platform that provides autonomous threat prevention, detection, and response across endpoints, cloud workloads, and IoT devices. It uses AI-powered behavioral analysis to detect and respond to threats in real-time.
Permissions for SentinelOne Integration
Viewer role is the minimum required permission for read-only access to:
Agents (devices)
Alerts
System information
How to Connect Scytale and SentinelOne
1. In Scytale, go to 'Integrations'.
2. Search for SentinelOne and select 'Connect'.
3. Enter your Tenant ID (This is typically your sub-domain. E.g. https://<TENANT-ID>.sentinelone.net)
4. Paste your API key
5. Add a connection name - this will be used to differentiate between your connections - and then select 'Connect'.
You have now successfully connected to SentinelOne!
How to create an API Key in SentinelOne
API token generation for Admin:
In user perspective, open ‘My User’
Select Actions → API Token Operations → Generate API Token (copy the API Token)
API token via Service User
Go to Settings → Users Service Users
Select Actions → Create Service user
Assign the Viewer role (minimum required)
Copy the API token immediately (shown only once!)
