SentinelOne Integration

Integrate SentinelOne with Sprinto to automatically sync device and vulnerability data for continuous compliance monitoring and evidence collection.

The SentinelOne integration enables Sprinto to automatically ingest device and vulnerability data from your SentinelOne environment. This helps you monitor security posture, track threats, and map vulnerabilities to compliance controls without manual effort.

This integration is currently available under a beta programme and uses a secure, managed connection flow.

---

Prerequisites

Before you begin, ensure the following:

• You have an active SentinelOne account.

• You have admin access to SentinelOne.

• You are enrolled in Sprinto’s SentinelOne beta programme.

• Your SentinelOne environment allows access to:

  • Devices (endpoints).

  • Threats and vulnerability alerts.

• You have access to generate or authorise:

  • SentinelOne API credentials (via the connection flow).

  • SentinelOne base URL (if required during setup).

---

Permissions and data access

Sprinto requires read-level access to specific SentinelOne data.

Data accessed by Sprinto

• Device (endpoint) information.

• Vulnerabilities and threat alerts.

• Associated metadata for tracking and mapping.

Required permissions

During the connection flow, you must grant access to:

• View Devices/Agents – to list and track endpoints.

• View Threats/Alerts – to fetch vulnerabilities and security findings.

• (Optional) View Policies – for additional context.

These permissions are granted during the authorisation flow and managed externally.

---

Data sync behaviour

Sprinto syncs SentinelOne data in two stages:

1. Device sync

• Fetches all available devices.

• Registers them as tracked entities in Sprinto.

2. Vulnerability sync

• Fetches vulnerabilities and threat alerts.

• Maps them only to tracked devices.

• Ignores data from untracked entities.

This ensures accurate and relevant compliance tracking.

---

How it works

Sprinto integrates with SentinelOne through a secure intermediary integration layer instead of directly calling SentinelOne APIs.

• Authentication is handled through a secure authorisation (link) flow.

• Credentials are not directly stored in Sprinto.

• Once connected, Sprinto:

  • Retrieves device (endpoint) data.

  • Fetches vulnerabilities and threat alerts.

  • Maps the data to relevant controls and checks.

• Data is periodically synced and automatically updated.

This approach ensures secure credential handling and reliable data ingestion.

---

Enrol in SentinelOne Beta

Since SentinelOne is currently in beta, you must enrol before connecting.

1. Log in to the Sprinto dashboard.

2. Navigate to Settings → Integrations.

3. In the All tab, search for SentinelOne.

1. Click Know more next to SentinelOne.

2. In the side panel, click Enroll in Beta.

After submitting your request, Sprinto will review and enable access.

---

Connect SentinelOne to Sprinto

Once beta access is enabled:

1. Log in to the Sprinto dashboard.

2. Navigate to Settings → Integrations.

3. Search for SentinelOne in the All tab.

4. Click Connect.

Step 1: Review permissions

1. Review the permissions and data accessed:

   • Read access to vulnerabilities.

   • Device data.

2. Click Next.

Step 2: Initiate connection

1. Select I have admin access to SentinelOne.

2. Click Connect to SentinelOne.

Step 3: Authorise and enter credentials

1. Complete the secure authorisation flow.

2. In the pop-up, enter the API Token & Base URL. Know more about how to obtain these credentials.

3. Click Create to complete the setup.

---

Post-connection flow

After a successful connection:

• The integration status is shown as Connected.

• Sprinto begins syncing:

  • Devices (endpoints).

  • Vulnerabilities and alerts.

• Relevant controls and checks are automatically enabled.

• Evidence collection begins without manual intervention.

---

Error handling

Sprinto automatically detects and flags issues related to authentication or permissions.

Common scenarios

Authentication failure (401). Occurs when the connection is invalid or expired. Action: Reconnect the integration.

Permission issues (403). Occurs when required permissions are not granted. Action: Re-authorise with appropriate access.

Invalid connection. Occurs when the connection cannot be validated. Action: Re-establish the integration.

Data sync limits

• Sprinto enforces rate limits to ensure stable performance.

• Data is fetched in controlled intervals to avoid overload.

---

Troubleshooting

Unable to see Connect button

• Ensure you are enrolled in the beta programme.

• Wait for confirmation from Sprinto.

Connection fails

• Verify API token and base URL are correct.

• Ensure admin access is enabled.

• Confirm required permissions are granted.

No data syncing

• Check if SentinelOne has active devices and alerts.

• Allow time for initial sync.

• Reconnect the integration if needed.

---

Additional notes

• SentinelOne integration uses a managed connection flow, not direct API configuration.

• Credentials are handled securely outside Sprinto.

• Only vulnerabilities linked to tracked devices are synced.

• This feature is currently in beta and may evolve.

---

Support

Please contact Sprinto Support If you have any queries related to the integration or need any assistance.