---
title: "Integrate SentinelOne Cloud Funnel with Red Canary"
slug: "integrate-sentinelone-cloud-funnel-with-red-canary"
updated: 2026-11-03T21:34:28Z
published: 2026-11-03T21:34:28Z
canonical: "docs.redcanary.com/integrate-sentinelone-cloud-funnel-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate SentinelOne Cloud Funnel with Zscaler MDR

Zscaler MDR connects to SentinelOne through a data-streaming product called Cloud Funnel. Created in partnership between Zscaler MDR and SentinelOne's engineering teams, Cloud Funnel allows us to stream deep-visibility telemetry from SentinelOne into the Zscaler MDR engine. In addition, Cloud Funnel is an XDR data lake that utilizes an Amazon S3 Bucket to enable Zscaler MDR to tap into your telemetry stream.

While most SentinelOne integrations are focused on the alerts generated by the platform, the Zscaler MDR low-level Cloud Funnel connection ingests both the alerts and raw telemetry generated by the SentinelOne Sentinel Agent. This telemetry is processed and analyzed by the Zscaler MDR platform and then by our Cyber Incident Response Team (CIRT) to confirm and investigate threats while eliminating false positives.

## Prerequisites

Zscaler MDR offers two methods to integrate with SentinelOne, depending on how Cloud Funnel is currently configured. Choose the strategy that aligns with your existing data handling to ensure that SentinelOne data flows seamlessly to Zscaler MDR. The prerequisites for the integration vary according to which method you use.

#### Integration Method 1: Cloud Funnel exports to Zscaler MDR’s AWS S3 Bucket

This is the most common and straightforward approach, allowing SentinelOne data to be sent directly to Zscaler MDR. The following prerequisites must be met:

- Your SentinelOne user account must have Admin level access
- Cloud Funnel must be enabled in your SentinelOne account to support the data export (see below)

#### Integration Method 2: Cloud Funnel exports to a non-Zscaler MDR AWS S3 Bucket

If your SentinelOne Cloud Funnel is already forwarding data to an AWS S3 bucket and you want Zscaler MDR to retrieve it from there, additional AWS permissions are required. Please note that this integration method may result in increased AWS costs, as well as a more complex and time-intensive integration process. The following prerequisites must be met:

- Your SentinelOne user account must have Admin level access
- Cloud Funnel must be enabled in your SentinelOne account to support the data export (see below)
- The following AWS Permissions must be set to facilitate data flow:
  - **Create SNS Topics** for data event notifications to Zscaler MDR
  - **Create IAM Roles** to securely manage access between AWS resources
  - **Set S3 Bucket Notifications** to trigger Zscaler MDR data ingestion upon new data uploads

> [!WARNING]
> Important
> 
> The object key format of your S3 bucket must use the same structure as the initial data delivered by Cloud Funnel. If you change the object key format, Zscaler MDR won’t be able to ingest the endpoint telemetry.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Sentinel-One-External-Bucket.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

#### How to make sure Cloud Funnel is enabled

1. Log in to the **SentinelOne Management Console**.
2. On the navigation menu, click **Settings,** then go to the **Accounts** tab and click the ![sentinelone-p_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-p_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D) action next to the account being integrated with Zscaler MDR. ![sentinelone-p_02](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-p_02.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
3. On the **Edit Account** page, review the **Add-ons** section. ![sentinelone-p_03](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-p_03.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
  - If the **Cloud Funnel** option is visible, make sure it’s selected
  - If the **Cloud Funnel** option isn’t visible, reach out to whomever you purchased your licenses through and request that they purchase and enable Cloud Funnel

## 1 Zscaler MDR | Add the Integration

1. In the Zscaler MDR portal, go to the **Integrations** page, then click **Add Integration**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. On the **Add integration** dialog, search for the **SentinelOne with Cloud Funnel** integration, then click **Configure**. ![sentinelone-1_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-1_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
3. On the **Zscaler MDR configuration page**, enter a name for the integration. ![sentinelone-1_02](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-1_02.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

## 2 Zscaler MDR | Choose the Scope of the Integration

1. On the **Zscaler MDR configuration page**, set the scope of the integration to be either Account or Site.
  - **Accounts** - Ingest and monitor data from your entire SentinelOne tenant
  - **Site** - Ingest and monitor data from a single site within your SentinelOne tenant

![sentinelone-2_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. Click **Next**.

## 3 SentinelOne/Zscaler MDR | Provide the SentinelOne Account Details

1. In the **SentinelOne Management Console**, make a note of the SentinelOne Management API Host URL from the browser address bar. For example: `https://usea1-canaria.sentinelone.net`
2. On the navigation menu, click **Settings,** then go to the **Accounts** tab or the **Sites** tab and click on the account or site you’re integrating.

![sentinelone-3_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-3_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
3. On the navigation menu, click **Sentinels**, then go to the **Account Info** or **Site Info** tab and make a note of the Account ID or Site ID.![sentinelone-3_02](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-3_02.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
4. On the **Zscaler MDR configuration page**:

![sentinelone-3_03](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-3_03.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
  - Enter the SentinelOne Management API Host URL into the **API Host** field.
  - Enter the Account ID or Site ID into the **Account ID** or **Site ID** field.
5. Click **Next**.

## 4 Zscaler MDR | Choose Your Cloud Funnel Configuration

#### Is Cloud Funnel already configured for your SentinelOne Account?

1. In **Section 3a**, select the option that best matches your current data routing:

![sentinelone-4_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-4_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
  - **No** - Choose this option if you’re following Integration Method 1 and Cloud Funnel isn’t already configured. For an Account-scoped integration, Zscaler MDR will configure Cloud Funnel for you. For a Site-scoped integration, you must follow the the steps under *Enable Cloud Funnel* to manually configure your SentinelOne site.
  - **Yes, Cloud Funnel already exports to Zscaler MDR’s rc-sentinelone-us-east-2 AWS S3 Bucket** - Choose this option if you’re following Integration Method 1 and Cloud Funnel is already configured (for example, if you’re onboarding additional sites).

> [!NOTE]
> **Note:** The S3 bucket name is different for other AWS regions: EU: sentinelone-cf2.eu01.redcanary.co
> 
> IND: sentinelone-cf2.ind01.redcanary.co
  - **Yes, Cloud Funnel already exports to a non-Zscaler MDR AWS S3 Bucket** - Choose this option if you’re following Integration Method 2 (your data is sent to an existing S3 bucket in your AWS account) For the additional required setup, follow the steps under the *Record information about the AWS S3 bucket where Cloud Funnel is already exporting data to* and *Provision an AWS IAM role that Zscaler MDR will assume to read from the above AWS S3 bucket* sections.
2. When you’ve completed any optional steps, click **Next**.

#### Enable Cloud Funnel

> [!NOTE]
> OPTIONAL
> 
> You only need to complete this step if you’re doing a Site-scoped integration and Cloud Funnel isn’t already configured for your SentinelOne account.

1. Follow the integration UI instructions in **Section 3b** to configure Cloud Funnel in the SentinelOne Management Console. ![sentinelone-4_02](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-4_02.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. When done, check the **I’ve enabled Cloud Funnel** box.

#### Record information about the AWS S3 bucket where Cloud Funnel is already exporting data to

> [!NOTE]
> **OPTIONAL**
> 
> You only need to complete this step if Cloud Funnel already exports to a non-Zscaler MDR AWS S3 Bucket (Integration Method 2).

1. In **Section 3b**, enter the details for your Cloud Funnel AWS S3 bucket and SNS Topic. For more information, please see the [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html). ![sentinelone-4_03](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-4_03.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

#### Provision an AWS IAM role that Zscaler MDR will assume to read from the above AWS S3 bucket

> [!NOTE]
> **OPTIONAL**
> 
> You only need to complete this step if Cloud Funnel already exports to a non-Zscaler MDR AWS S3 Bucket (Integration Method 2).

1. In **Section 3c**, select either CloudFormation or Terraform to generate a template you can use to provision an AWS IAM role that will allow Zscaler MDR to read from the S3 bucket you configured in Step 3b. ![sentinelone-4_04](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-4_04.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)These permissions are required for the following purposes:

| Permission | Needed for… |
| --- | --- |
| *S3 bucket permissions requested on the provided bucket* |
| s3:GetObjectAttributes | Fetching information about data in the bucket |
| s3:GetObject | Fetching data in the bucket |
| s3:ListBucket | Listing data in the bucket in case of troubleshooting or replay |
| s3:GetBucketNotification | Listing bucket SNS notification configurations in case of troubleshooting |
| s3:GetBucketLocation | Retrieving information about the bucket in order to fetch bucket data |
| *SNS topic permissions requested on the provided topic* |
| sns:Subscribe | Creating a subscription on the topic (limited in the policy to only allow subscriptions to SNS topics in the Zscaler MDR AWS account) |
| sns:ListSubscriptionsByTopic | Seeing if our queues are subscribed to the topic |
| sns:ConfirmSubscription | Confirming subscriptions after they’ve been created |
| sns:Unsubscribe | Removing subscriptions to the SNS topic in case of decomissioning |
2. Once the IAM role is set up in AWS, check the **I’ve provisioned the IAM role red-canary-partner-access-s1cf with appropriate permissions** box (for US regions) or the **I’ve provisioned the IAM role sentinelone-partner-s3-export-access with appropriate permissions** box (for EU and IND regions).

## 5 SentinelOne | Create an API token

> [!NOTE]
> NOTE
> 
> The SentinelOne user for this step must have permission to generate API tokens. Please see the SentinelOne documentation for more information. The integration will no longer function if the user who created the token is disabled or has their permissions changed.
> 
> 
> 
> If you’re a consulting partner, your integration process for this step will be different. Please follow your [partner provisioning documentation](https://support.redcanary.com/hc/en-us/sections/15285065004823-Provisioning).

1. In the **SentinelOne Management Console**, open your user profile dropdown, then click **My User**. ![sentinelone-5_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-5_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. Open the **Actions** dropdown and select **API Token Operations > Generate API Token**. ![sentinelone-5_02](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-5_02.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

> [!NOTE]
> NOTE
> 
> The SentinelOne Management Console might prompt you for 2FA authentication in order to generate the token.
3. Click the link to copy the API Token.![sentinelone-5_03](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-5_03.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

## 6 Zscaler MDR | Provide Zscaler MDR with the API Token

1. On the **Zscaler MDR configuration page**, paste the copied token from the previous section into the **API Token** field. ![sentinelone-6_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-6_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. Click **Next**.

> [!NOTE]
> NOTE
> 
> SentinelOne API tokens expire every 30 days. Zscaler MDR will automatically renew the token via a service account.

## 7 SentinelOne/Zscaler MDR | Create a SentinelOne User Account for Zscaler MDR

Zscaler MDR needs access to a SentinelOne Admin-level account in order to monitor the integration. Once the Admin account is created, Zscaler MDR will automatically add an additional Viewer-level service account for our Customer Security Operations (CSO) team. If you’ve purchased Active Remediation, Zscaler MDR will also create an Incident Response (IR) Team service account. These accounts will access your environment using the fewest permissions possible.

> [!NOTE]
> NOTE
> 
> If you’re a consulting partner, your integration process for this step will be different. Please follow your [partner provisioning documentation](https://support.redcanary.com/hc/en-us/sections/15285065004823-Provisioning).

1. On the **Zscaler MDR configuration page**, locate the pre-populated **Full Name** and **Email Address** values. ![sentinelone-7_01](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-7_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. In the **SentinelOne Management Console**, click **Settings** on the navigation menu and go to the **Users** tab.
3. Select **Console Users**, then select **Add New User** from the **Actions** dropdown. ![sentinelone-7_02](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-7_02.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
4. Create the new user by copying the **Full Name** and **Email Address** values from the **Zscaler MDR integration page**. For example:

![sentinelone-7_03](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-7_03.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
  - `Zscaler MDR Access`
  - `svc-s1+canariacorp@redcanary.com`
5. Click **Next**.
6. On the **Select Scope of Access** screen, choose the appropriate level of access (**Account** or **Site**).
7. Select the account or site that Zscaler MDR is gaining access to, then change **Viewer** to **Admin** in the user type dropdown. ![sentinelone-7_04](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-7_04.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
8. Click **Create User**.
9. Once the Admin account is created in SentinelOne, return to the **Zscaler MDR configuration page** and check the **I’ve created the user** box. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-7_05.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

## 8 Zscaler MDR | Customize How Data is Retained

[OPTIONAL] If you’re subscribed to the [Zscaler Security Data Lake](/doc/docs/getting-started-with-the-security-data-lake) managed storage solution, you can choose to copy the telemetry generated by the integration to long-term storage for later query or retrieval.

1. Check the **Store in the Security Data Lake** box.
2. Enter your desired data retention period in days. The maximum is 1095 days (three years). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-8_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)

## 9 Zscaler MDR | Activate the Integration

After you’ve completed the configuration, click **Save** to activate the integration.

> [!TIP]
> The SentinelOne integration is now live!
> 
> You should see SentinelOne alerts start appearing in Zscaler MDR within one hour.

## 10 Zscaler MDR | Modify the Integration

After the SentinelOne integration is active, you can make the following modifications to the configuration:

- Update the API management token
- Adjust the Security Data Lake retention period
- Decommission the integration

To modify the configuration:

1. In the Zscaler MDR portal, go to the **Integrations** page, then click on the name of the integration you want to modify. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/sentinelone-9_01.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D)
2. After you’ve finished editing the configuration, click **Save** to apply your changes.

#### Decommissioning the Integration

To remove the integration from Zscaler MDR, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button-2.png?sv=2026-02-06&spr=https&st=2026-11-04T14%3A19%3A00Z&se=2026-11-04T15%3A19%3A00Z&sr=c&sp=r&sig=YE7So%2F68ecEsmrWUrxOB%2F57kV3eNma7oqPu9JVFbNYI%3D) button, then click **OK** to confirm.

> [!WARNING]
> Important
> 
> If you decommission the integration, no new alerts will be sent to Zscaler MDR. Although threats will be retained, all processed alerts will be deleted. This action cannot be undone.