--- title: "SentinelOne Integration FAQ" slug: "sentinelone-integration-faq" updated: 2026-09-09T16:09:35Z published: 2026-09-09T16:09:35Z canonical: "docs.redcanary.com/sentinelone-integration-faq" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # SentinelOne Integration FAQ --- ### #### What Zscaler MDR automation actions are available for SentinelOne? Currently, the following automation actions are available for SentinelOne: - Ban File Hashes (IOC) - Ban IP Addresses (IOC) - Isolate Endpoint - Deisolate Endpoint - Collect Forensics - Delete/Capture Files (IOC) See [Response Actions for SentinelOne](/doc/docs/response-actions-for-sentinelone) for more details. #### What kind of SentinelOne data does Zscaler MDR process? We receive all the data collected by your SentinelOne agents, as well as a number of system events generated by the SentinelOne Singularity platform. Telemetry that is visible in SentinelOne Deep Visibility (Endpoint telemetry) is used for detection purposes, whereas several system events become audit logs in the Zscaler MDR platform. #### What happens to my SentinelOne alerts when I activate Zscaler MDR? Every alert generated by SentinelOne's detection rules is consumed by Zscaler MDR and provided to you in the Alerts feature of the Zscaler MDR platform. Alerts are reviewed by Zscaler MDR’s Cyber Incident Response Team (CIRT), who add additional context to confirmed alerts to accelerate your response. #### What are the networking requirements for SentinelOne? If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following document to learn about the network requirements for your sensors to communicate properly and behave as expected: [Services and Ports for Management](https://usea1-redcanary.sentinelone.net/docs/en/services-and-ports-for-management.html) If you’re using your own environment, you can find the document via the Help link in the SentinelOne top menu. #### How do I deploy my Virtual Desktop Infrastructure? If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about installing installing, deploying, and configuring your VDI: [VDI and VM deployment](https://usea1-redcanary.sentinelone.net/docs/en/vdi-and-vm-deployment.html) [Installing Windows Agents on VM or VDI](https://usea1-redcanary.sentinelone.net/docs/en/installing-windows-agents-on-vm-or-vdi.html) If you’re using your own environment, you can find these documents via the Help link in the SentinelOne top menu. #### How do I install SentinelOne Agents? If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about installing SentinelOne Agents: [Installing Agents on Windows Endpoints](https://usea1-redcanary.sentinelone.net/docs/en/installing-agents-on-windows-endpoints.html) [Installing Agents on macOS Endpoints](https://usea1-redcanary.sentinelone.net/docs/en/installing-agents-on-macos-endpoints.html) [Installing and Upgrading macOS Agents with Jamf](https://usea1-redcanary.sentinelone.net/docs/en/installing-and-upgrading-macos-agents-with-jamf.html) If you’re using your own environment, you can find these documents via the Help link in the SentinelOne top menu. #### How do I uninstall EDR Agents from the Command Line Interface (CLI)? If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about uninstalling EDR Agents from the CLI or via the Management Console: [Uninstalling Agents from the CLI](https://usea1-redcanary.sentinelone.net/docs/en/uninstalling-agents-from-the-cli.html) [Uninstalling Agents from the Management Console](https://usea1-redcanary.sentinelone.net/docs/en/uninstalling-agents-from-themanagement.html) If you’re leveraging your own environment, you can find these documents via the Help link in the SentinelOne top menu. #### Can Zscaler MDR assist with setting up SentinelOne Cloud Funnel to export its data to my own S3 bucket? Setting up SentinelOne Cloud Funnel to export its data to a customer-owned S3 bucket is an advanced configuration that is dependent on your individual cloud environment. Zscaler MDR does not provide assistance with this setup. If you have any questions or encounter issues, we recommend reaching out to SentinelOne Support for guidance and to ensure your SentinelOne account is properly configured before integrating it with Zscaler MDR. #### Why don’t I land on the search results page when I follow a SentinelOne link in the Zscaler MDR portal? The Zscaler MDR platform provides links to the source EDR platform that make it easy to investigate noted entities and activities. For SentinelOne, you must follow these steps in order to be successfully redirected with the appropriate query parameters set when you click a link in Zscaler MDR. 1. Log in to the **SentinelOne Management Console,** open the user profile dropdown in the menubar, then click **My User**. 2. In the **Feature Preferences** section, make sure **Change Deep Visibility Mode** is set to “Enhanced.” ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-faq001.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D) 3. Navigate to the **Enhanced Visibility** page. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-faq002.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D) Visiting this page will update your browser cookies to enable subsequent redirects from Zscaler MDR to SentinelOne. #### How do I compare my active endpoints in Zscaler MDR to SentinelOne Sensor performance, network communication issues, endpoint performance, or network communication issues can affect whether your Zscaler MDR endpoint count and SentinelOne endpoint count match up. It may also be possible, however unlikely, that there is some type of communication issue between the SentinelOne Server and Zscaler MDR. It’s always a good idea to check these numbers to ensure that Zscaler MDR is receiving telemetry from the number of endpoints you expect from SentinelOne. **To count active endpoints in Zscaler MDR:** 1. Go to the **Endpoints** page in the Zscaler MDR portal. 2. In the search bar, enter `last_checkin_time:` with today’s date. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-faq003.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D) This gives you the number of endpoints that have checked in with Zscaler MDR so far today. You’ll use this number to compare to the number of endpoints being monitored in SentinelOne. Note that the Last Check In Time is in UTC when comparing your results to SentinelOne. **To count active endpoints in SentinelOne:** 1. In the SentinelOne Management console, click **Sentinels** on the navigation menu and go to the **Endpoints** tab. 2. Click in the **Select filters** field, and then click **View More Filters**. 3. Deselect any default filters then select **Connected to Management,** 4. Click **Back to filters**. A new **Connected to Management** panel displays with metrics for **Yes** and **No**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-faq004.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D) The Yes metric shows you the number of endpoints considered Connected to Management and actively checking in with the SentinelOne server. This is the number to compare to Zscaler MDR. **Troubleshooting:** If you notice a large disparity between the number of active endpoints in Zscaler MDR compared to SentinelOne, examine the endpoints in SentinelOne. Here are a few things to look for: - Is the endpoint online? - Is the Zscaler MDR sensor running on the endpoint? - Is the Zscaler MDR sensor communicating with SentinelOne? If you discover that a sensor isn’t communicating or isn’t connected to SentinelOne, review SentinelOne’s help documentation. To access the help documentation, log in to SentinelOne, click the question mark icon, and then select **Help**. If you need additional assistance, please submit a request with Zscaler MDR Support. #### Why do I have a large number of endpoints reporting as not sending telemetry? The Deep Visibility feature is what collects and sends endpoint data to SentinelOne, and by extension to Zscaler MDR. SentinelOne uses policy inheritance to control settings throughout the account/site/group structure. If you have a site or group that has policy inheritance disabled, then any changes made at the account level, like enabling Deep Visibility, will not be inherited. To correct this, you’ll need to enable policy inheritance in SentinelOne. 1. In the SentinelOne Management console, click **Sentinels** on the navigation menu and go to the **Policy** tab. 2. In the **Deep Visibility** section, make sure **Enable Deep Visibility** is turned on then enable everything except **Data Masking** and **Focused File Monitoring**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-faq005.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D) 3. Click the **Event Type Configuration** link and enable all the options in the **File** section. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-faq006.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D) > [!NOTE] > Note > > Make sure Data Masking is disabled. Also, leaving any boxes unchecked under Event Type Configuration will trigger a status failure in Zscaler MDR.