SentinelOne

To attach SentinelOne to your instance of Prelude, you will need 3 items:

• Base URL - (IE: https://usea1-partners.sentinelone.net/)
• Account ID
• API Secret

You can attach SentinelOne using the PreludeCLI or the Detect console

Prelude CLI

prelude partner attach sentinelone --api <https://usea1-partners.sentinelone.net> --user <AccountID> --secret <API Secret>

Detect Console

Navigate to integrations page by clicking your username in the top right -> Account Settings -> Integrations:

Obtain BaseURL

You can obtain the base url from your SentinelOne instance browser window or follow the directions below.

1. Login to SentinelOne
2. Click on Help -> API Doc
3. Expand Accounts -> Click on Create Account
4. Click run on console
5. Click Run API query
6. The URL will be displayed. Click Copy URL.
   An example provided URL: https://usea1-partners.sentinelone.net/web/api/v2.1/accounts
   Remove everything after the .net: https://usea1-partners.sentinelone.net

Obtain Account ID

1. Login to SentinelOne and navigate to Account Scope
2. Select the Sentinels page
3. Click on "Account Info"
4. The Account ID is displayed. Copy Account ID

Obtain API Secret

Option 1: Create a custom role and service account for the Prelude Integration

1. Navigate to Settings -> Users -> Roles
2. Create new role for Prelude Integration with the following permissions scoped to the Account
   • Endpoints
     • View
   • Endpoint Threats
     • View
     • Update Incident Status
     • Update Analyst Verdict
   • Endpoint Policy
     • View
3. Create new service account using the role created above and copy/save the token securely, this token will not be available to view again without creating a new one.

Option 2: User Account API Token

1. Login to Sentinel One
2. Click on Settings
3. Click on Users tab
4. Click on your console user -> you’ll see a modal for the selected user
5. Click on the Actions drop down -> API Token Operations -> Generate API token
   Your API Token is displayed. Copy and save the token securely, this token will not be available to view again without creating a new one.