Integrate SentinelOne Cloud Funnel with Zscaler MDR

Zscaler MDR offers two methods to integrate with SentinelOne, depending on how Cloud Funnel is currently configured. Choose the strategy that aligns with your existing data handling to ensure that SentinelOne data flows seamlessly to Zscaler MDR. The prerequisites for the integration vary according to which method you use.

Integration Method 1: Cloud Funnel exports to Zscaler MDR’s AWS S3 Bucket

This is the most common and straightforward approach, allowing SentinelOne data to be sent directly to Zscaler MDR. The following prerequisites must be met:

• Your SentinelOne user account must have Admin level access

• Cloud Funnel must be enabled in your SentinelOne account to support the data export (see below)

Integration Method 2: Cloud Funnel exports to a non-Zscaler MDR AWS S3 Bucket

If your SentinelOne Cloud Funnel is already forwarding data to an AWS S3 bucket and you want Zscaler MDR to retrieve it from there, additional AWS permissions are required. Please note that this integration method may result in increased AWS costs, as well as a more complex and time-intensive integration process. The following prerequisites must be met:

• Your SentinelOne user account must have Admin level access

• Cloud Funnel must be enabled in your SentinelOne account to support the data export (see below)

• The following AWS Permissions must be set to facilitate data flow:

  • Create SNS Topics for data event notifications to Zscaler MDR

  • Create IAM Roles to securely manage access between AWS resources

  • Set S3 Bucket Notifications to trigger Zscaler MDR data ingestion upon new data uploads

Important

The object key format of your S3 bucket must use the same structure as the initial data delivered by Cloud Funnel. If you change the object key format, Zscaler MDR won’t be able to ingest the endpoint telemetry.

1. In the Zscaler MDR portal, go to the Integrations page, then click Add Integration.
   

2. On the Add integration dialog, search for the SentinelOne with Cloud Funnel integration, then click Configure.
   

3. On the Zscaler MDR configuration page, enter a name for the integration.
   

1. On the Zscaler MDR configuration page, set the scope of the integration to be either Account or Site.

   • Accounts - Ingest and monitor data from your entire SentinelOne tenant

   • Site - Ingest and monitor data from a single site within your SentinelOne tenant

     

2. Click Next.

1. In the SentinelOne Management Console, make a note of the SentinelOne Management API Host URL from the browser address bar. For example:
   https://usea1-canaria.sentinelone.net

2. On the navigation menu, click Settings, then go to the Accounts tab or the Sites tab and click on the account or site you’re integrating.

   

3. On the navigation menu, click Sentinels, then go to the Account Info or Site Info tab and make a note of the Account ID or Site ID.

4. On the Zscaler MDR configuration page:

   • Enter the SentinelOne Management API Host URL into the API Host field.

   • Enter the Account ID or Site ID into the Account ID or Site ID field.

   

5. Click Next.

NOTE

The SentinelOne user for this step must have permission to generate API tokens. Please see the SentinelOne documentation for more information. The integration will no longer function if the user who created the token is disabled or has their permissions changed.

       

If you’re a consulting partner, your integration process for this step will be different. Please follow your partner provisioning documentation.

1. In the SentinelOne Management Console, open your user profile dropdown, then click My User.
   

2. Open the Actions dropdown and select API Token Operations > Generate API Token.
   

   NOTE

   The SentinelOne Management Console might prompt you for 2FA authentication in order to generate the token.

3. Click the link to copy the API Token.

1. On the Zscaler MDR configuration page, paste the copied token from the previous section into the API Token field.
   

2. Click Next.

NOTE

SentinelOne API tokens expire every 30 days. Zscaler MDR will automatically renew the token via a service account.

Zscaler MDR needs access to a SentinelOne Admin-level account in order to monitor the integration. Once the Admin account is created, Zscaler MDR will automatically add an additional Viewer-level service account for our Customer Security Operations (CSO) team. If you’ve purchased Active Remediation, Zscaler MDR will also create an Incident Response (IR) Team service account. These accounts will access your environment using the fewest permissions possible.

NOTE

If you’re a consulting partner, your integration process for this step will be different. Please follow your partner provisioning documentation.

1. On the Zscaler MDR configuration page, locate the pre-populated Full Name and Email Address values.
   

2. In the SentinelOne Management Console, click Settings on the navigation menu and go to the Users tab.

3. Select Console Users, then select Add New User from the Actions dropdown.
   

4. Create the new user by copying the Full Name and Email Address values from the Zscaler MDR integration page. For example:

   • Zscaler MDR Access

   • svc-s1+canariacorp@redcanary.com

   

5. Click Next.

6. On the Select Scope of Access screen, choose the appropriate level of access (Account or Site).

7. Select the account or site that Zscaler MDR is gaining access to, then change Viewer to Admin in the user type dropdown.
   

8. Click Create User.

9. Once the Admin account is created in SentinelOne, return to the Zscaler MDR configuration page and check the I’ve created the user box.
   

[OPTIONAL] If you’re subscribed to the Zscaler MDR Security Data Lake managed storage solution, you can choose to copy the telemetry generated by the integration to long-term storage for later query or retrieval. See Supported Integrations (Security Data Lake) for more information.

1. Check the Store in the Security Data Lake box.

2. Enter your desired data retention period in days. The maximum is 1095 days (three years).
   

After you’ve completed the configuration, click Save to activate the integration.

The SentinelOne integration is now live!

You should see SentinelOne alerts start appearing in Zscaler MDR within one hour.

After the SentinelOne integration is active, you can make the following modifications to the configuration:

• Update the API management token

• Adjust the Security Data Lake retention period

• Decommission the integration

To modify the configuration:

1. In the Zscaler MDR portal, go to the Integrations page, then click on the name of the integration you want to modify.
   

2. After you’ve finished editing the configuration, click Save to apply your changes.

Decommissioning the Integration

To remove the integration from Zscaler MDR, click the button, then click OK to confirm.

Important

If you decommission the integration, no new alerts will be sent to Zscaler MDR. Although threats will be retained, all processed alerts will be deleted. This action cannot be undone.