Skip to main content
SAFE Security

Course Catalog

All Topics

SentinelOne

  • By SAFE Security
  • Published: Oct 14, 2026
  • Rating
    Average rating: 0 No reviews

Outline

Introduction

The SAFE SentinelOne integration enables you to import endpoint inventory, installed software, and vulnerability data from SentinelOne into SAFE. By combining asset and vulnerability information, SAFE provides a unified view of endpoint security posture, helping security teams prioritize risks and improve cyber exposure management.

The integration uses the SentinelOne REST API v2.1 and securely pulls data from your SentinelOne tenant into SAFE. This is a unidirectional integration, SAFE only reads data from SentinelOne and never modifies your SentinelOne environment.

Data Pulled into SAFE

The integration imports the following data from SentinelOne:

Data Type Description
Asset Inventory Endpoint devices including hostname, IP addresses, MAC addresses, operating system, CPU, memory, serial number, domain, tags, site, and group information.
Software Inventory Installed applications, version, publisher, and installation date for each endpoint.
Device Vulnerabilities CVEs detected on individual endpoints, including severity, detection date, last scan date, and vulnerability status.
Application Vulnerabilities Application-level CVEs associated with installed software across managed endpoints.
Policies Effective endpoint protection policy read from the group, site, account, and tenant policy endpoints. Used as compensatory-control evidence showing which protections are actually enabled on the device.

Notes:

The integration does not ingest:

  • SentinelOne EDR threats and alerts
  • Configuration assessments or CIS benchmark results
  • User information

Data Synchronization Behavior

SAFE performs a scheduled sync with your SentinelOne.

Behavior Details
Sync Type Full synchronization with configurable time-window filters
Default Schedule Every 7 days
Device Devices active within the last 30 days by default (configurable)
Vulnerability Vulnerabilities updated within the last 180 days
Incremental/Delta Sync Not supported

Prerequisites and Permissions

Before configuring the integration, ensure you have:

  • Administrator or API management privileges on SentinelOne App

  • An API Token

  • Your SentinelOne Management Console URL

The API token must include the following permissions:

  • Endpoints - View

  • Applications - View, View Risks

  • Unified Asset Inventory - View

  • Endpoint Policy: View

Network or IP allowlisting requirements
Ensure SAFE can reach SentinelOne API endpoints. Allow SAFE IPs, if required by your network policy.

Generate Connection Details

Generate an API Token

  1. Log in to the SentinelOne Management Console and navigate to Policies and Settings > Roles.

  2. Click the New Role button.

  3. Enter the Role Name and Description.

  4. Search for and select the following permissions:

    1. Endpoints – View
    2. Applications – View, View Risks
    3. Unified Asset Inventory - View
    4. Endpoint Policy: View

  5. Click the Save button to save the role.

  6. Navigate to Policies and Settings > Service Users.

  7. Click the New Service User button.

  8. Enter the Service Name and Description.

  9. Select an Expiration Date.

  10. Under Permissions, set the Scope of Access to Site.

  11. Select the required Site(s) and assign the Role that you created in the previous steps.

  12. Click the Create Service User button.

  13. Authenticate if prompted. The system will display the API Token.

  14. Copy and securely save the API Token and the SentinelOne Management Console URL (Base URL). The API token is only visible once during the creation.

Configure SentinelOne in SAFE

  1. Navigate to Integrations,

  2. Click the + Button at the top-right of the page.

  3. Seach and click the SentinelOne card.

  4. On the configuration page, enter the Integration Name.

  5. Enter the SentinelOne API Base URL (for example: https://usea1-att2.sentinelone.net).

  6. Enter the API Token.

  7. [Optional] Enter optional SentinelOne agent filters as comma-separated key=value pairs. For example: lastActiveDate=30, siteIds=123. Use parameter names and values supported by SentinelOne. Leave blank to apply no additional filters.

  8. Enter a value in days for the Asset Last seen days filter field. This is the maximum allowed age of assets (in days) while populating the data from the source.

  9. Set the Auto-Sync frequency in days.

  10. Fetch security policies: Pulls the effective endpoint protection policy from SentinelOne at the group, site, account, and tenant levels. This data is used as compensatory-control evidence, since it shows which protections are actually enabled on a device. This option is enabled by default. If you don't need policy data, clear the Fetch Policies checkbox to turn it off.

  11. Click the Test Connection.

  12. Once the connection is verified, click Save.

  13. Click the Sync Now to trigger an on-demand sync.

API Details

The integration uses the SentinelOne REST API v2.1.

Endpoint Purpose
GET /agents Retrieve endpoint inventory
GET /agents/applications?ids={id} Retrieve installed software per device
GET /application-management/risks Retrieve endpoint vulnerabilities
GET /application-management/risks/applications Retrieve risky applications
GET /application-management/risks/cves Retrieve application vulnerabilities
POST /web/api/v2.1/xdr/assets Retrieve Asset Type

Limitations

Limitation Description
No Delta Sync The connector performs a full refresh during each synchronization. Data is scoped using configurable time-window filters.
User Ingestion Not Supported This connector does not ingest user information from SentinelOne.
Configuration Assessment Not Supported SentinelOne does not expose CIS benchmark or configuration assessment data through the APIs used by this integration.

FAQs

What data does this integration import?

The integration imports endpoint inventory, installed software, device vulnerabilities, and application vulnerabilities.

Does this integration import SentinelOne EDR alerts?

No. Endpoint detections and EDR alerts will be supported through a separate SentinelOne EDR integration.

Does SAFE make changes to my SentinelOne environment?

No. SAFE only reads data from SentinelOne.

Why are no devices being imported?

Verify that:

  • The API token has the required permissions.

  • Devices have been active within the configured Asset Last Seen period.

  • The API Base URL is correct.

How often does synchronization occur?

By default, every 7 days. The schedule can be modified during configuration.

Is incremental synchronization supported?

No. Each synchronization performs a full refresh using configurable time-window filters.

Why is vulnerability synchronization taking longer than expected?

Large SentinelOne environments require SAFE to retrieve software and vulnerabilities for many endpoints. Synchronization time varies depending on tenant size and SentinelOne API rate limits.

Did this article help?

Let us know by leaving a star rating at the top of this article.