Response Actions for SentinelOne

The following response actions are available for SentinelOne in the Red Canary Automation interface:

• Ban File Hashes (IOC)

• Ban IP Addresses (IOC)

• Isolate Endpoint

• Deisolate Endpoint

• Collect Forensics

• Delete/Capture Files (IOC)

The Collect Forensics and Delete/Capture Files actions each require you to activate an add-on in SentinelOne.

You can activate these add-ons in SentinelOne as follows:

1. Log in to your SentinelOne Management Console.

2. On the navigation menu, click Settings, then go to the Sites tab and locate the account integrated with Red Canary.
   

3. Check the box next to the account, then select Edit site from the Actions dropdown.
   

4. Scroll down to the Add-ons section and select the add-on you want to activate (Remote Script Orchestration or RemoteOps Forensics).
   
   

   Note: If these add-ons aren’t listed for your site, you’ll need to contact SentinelOne to request them.

5. Click Save Changes.