Skip to main content
To integrate SentinelOne you will need two pieces of information, the URL and the API Key of your SentinelOne account.

​
URL

SentinelOne uses different subdomains based on your region and who you purchased your licenses from. To get this value, log in to S1 and copy the URL from your address bar. It should look like https://usea1-011.sentinelone.net/. Using console[.]sentinelone[.]net is not a valid value.

​
API Key

To create an API Key you’ll need to create a service user. SentinelOne offers two console UIs; use the tab that matches the interface you see after logging in.
  1. Navigate to Settings > Users > Service Users.
  2. Select the dropdown Actions > Create New Service User.
  3. You may name it anything you’d like; we suggest Tier4.
  4. Set the expiration to a value you feel comfortable with; we suggest 1 year. When the token expires you will receive an email notification from us saying the integration is experiencing errors. We also suggest setting a calendar reminder to update the token before it expires.
  5. When prompted to Select Scope of Access, we recommend Site > Client for MSP setups so access is scoped to the client being onboarded. For single-tenant setups, choose Account or Site as appropriate for your environment.
  6. In the dropdown next to the site, change the value from Viewer to SOC.
  7. Click Create User.
  8. Copy the API token.
  9. Login to Tier4 and navigate to Integrations > SentinelOne and enter URL and API Key.
Use the built-in SOC role for this service user. SentinelOne includes this role by default.