---
title: "Response Actions for SentinelOne"
slug: "response-actions-for-sentinelone"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/response-actions-for-sentinelone"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Response Actions for SentinelOne

The following response actions are available for SentinelOne in the Zscaler MDR [Automation](/doc/docs/automation) interface:

- Ban File Hashes (IOC)
- Ban IP Addresses (IOC)
- Isolate Endpoint
- Deisolate Endpoint
- [Collect Forensics](/doc/docs/collect-a-forensics-package)
- Delete/Capture Files (IOC)

The Collect Forensics and Delete/Capture Files actions each require you to activate an add-on in SentinelOne.

| Zscaler MDR Response Action | Required SentinelOne Add-on |
| --- | --- |
| Collect Forensics | RemoteOps Forensics |
| Delete/Capture Files (IOC) | Remote Script Orchestration |

You can activate these add-ons in SentinelOne as follows:

1. Log in to your **SentinelOne Management Console**.
2. On the navigation menu, click **Settings,** then go to the **Sites** tab and locate the account integrated with Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/s1response_01.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A06Z&se=2026-11-09T13%3A08%3A06Z&sr=c&sp=r&sig=Ei%2FfOuGtvzsKFZ%2BvklINdy3Bq7Q27DchxEmCbDcYHsM%3D)
3. Check the box next to the account, then select **Edit site** from the **Actions** dropdown. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/s1response_02.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A06Z&se=2026-11-09T13%3A08%3A06Z&sr=c&sp=r&sig=Ei%2FfOuGtvzsKFZ%2BvklINdy3Bq7Q27DchxEmCbDcYHsM%3D)
4. Scroll down to the **Add-ons** section and select the add-on you want to activate (**Remote Script Orchestration** or **RemoteOps Forensics)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/s1response_03.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A06Z&se=2026-11-09T13%3A08%3A06Z&sr=c&sp=r&sig=Ei%2FfOuGtvzsKFZ%2BvklINdy3Bq7Q27DchxEmCbDcYHsM%3D)

> [!NOTE]
> **Note:** If these add-ons aren’t listed for your site, you’ll need to contact SentinelOne to request them.
5. Click **Save Changes**.