SentinelOne Integration FAQ

Currently, the following automation actions are available for SentinelOne:

• Ban File Hashes (IOC)

• Ban IP Addresses (IOC)

• Isolate Endpoint

• Deisolate Endpoint

• Collect Forensics

• Delete/Capture Files (IOC)

See Response Actions for SentinelOne for more details.

We receive all the data collected by your SentinelOne agents, as well as a number of system events generated by the SentinelOne Singularity platform. Telemetry that is visible in SentinelOne Deep Visibility (Endpoint telemetry) is used for detection purposes, whereas several system events become audit logs in the Red Canary platform.

Every alert generated by SentinelOne's detection rules is consumed by Red Canary and provided to you in the Alerts feature of the Red Canary platform. Alerts are reviewed by Red Canary's Cyber Incident Response Team (CIRT), who add additional context to confirmed alerts to accelerate your response.

If you’re leveraging Red Canary’s SentinelOne environment, log in to the Management Console and read the following document to learn about the network requirements for your sensors to communicate properly and behave as expected:

Services and Ports for Management

If you’re using your own environment, you can find the document via the Help link in the SentinelOne top menu.

If you’re leveraging Red Canary’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about installing installing, deploying, and configuring your VDI:

VDI and VM deployment
Installing Windows Agents on VM or VDI

If you’re using your own environment, you can find these documents via the Help link in the SentinelOne top menu.

If you’re leveraging Red Canary’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about installing SentinelOne Agents:

Installing Agents on Windows Endpoints
Installing Agents on macOS Endpoints
Installing and Upgrading macOS Agents with Jamf

If you’re using your own environment, you can find these documents via the Help link in the SentinelOne top menu.

If you’re leveraging Red Canary’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about uninstalling EDR Agents from the CLI or via the Management Console:

Uninstalling Agents from the CLI
Uninstalling Agents from the Management Console

If you’re leveraging your own environment, you can find these documents via the Help link in the SentinelOne top menu.

Setting up SentinelOne Cloud Funnel to export its data to a customer-owned S3 bucket is an advanced configuration that is dependent on your individual cloud environment. Red Canary does not provide assistance with this setup. If you have any questions or encounter issues, we recommend reaching out to SentinelOne Support for guidance and to ensure your SentinelOne account is properly configured before integrating it with Red Canary.

The Red Canary platform provides links to the source EDR platform that make it easy to investigate noted entities and activities. For SentinelOne, you must follow these steps in order to be successfully redirected with the appropriate query parameters set when you click a link in Red Canary.

1. Log in to the SentinelOne Management Console, open the user profile dropdown in the menubar, then click My User.

2. In the Feature Preferences section, make sure Change Deep Visibility Mode is set to “Enhanced.”
   

3. Navigate to the Enhanced Visibility page.
   

   Visiting this page will update your browser cookies to enable subsequent redirects from Red Canary to SentinelOne.