SentinelOne Integration FAQ

Currently, the following automation actions are available for SentinelOne:

• Ban File Hashes (IOC)

• Ban IP Addresses (IOC)

• Isolate Endpoint

• Deisolate Endpoint

• Collect Forensics

• Delete/Capture Files (IOC)

See Response Actions for SentinelOne for more details.

We receive all the data collected by your SentinelOne agents, as well as a number of system events generated by the SentinelOne Singularity platform. Telemetry that is visible in SentinelOne Deep Visibility (Endpoint telemetry) is used for detection purposes, whereas several system events become audit logs in the Zscaler MDR platform.

Every alert generated by SentinelOne's detection rules is consumed by Zscaler MDR and provided to you in the Alerts feature of the Zscaler MDR platform. Alerts are reviewed by Zscaler MDR’s Cyber Incident Response Team (CIRT), who add additional context to confirmed alerts to accelerate your response.

If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following document to learn about the network requirements for your sensors to communicate properly and behave as expected:

Services and Ports for Management

If you’re using your own environment, you can find the document via the Help link in the SentinelOne top menu.

If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about installing installing, deploying, and configuring your VDI:

VDI and VM deployment
Installing Windows Agents on VM or VDI

If you’re using your own environment, you can find these documents via the Help link in the SentinelOne top menu.

If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about installing SentinelOne Agents:

Installing Agents on Windows Endpoints
Installing Agents on macOS Endpoints
Installing and Upgrading macOS Agents with Jamf

If you’re using your own environment, you can find these documents via the Help link in the SentinelOne top menu.

If you’re leveraging Zscaler MDR’s SentinelOne environment, log in to the Management Console and read the following documents to learn more about uninstalling EDR Agents from the CLI or via the Management Console:

Uninstalling Agents from the CLI
Uninstalling Agents from the Management Console

If you’re leveraging your own environment, you can find these documents via the Help link in the SentinelOne top menu.

Setting up SentinelOne Cloud Funnel to export its data to a customer-owned S3 bucket is an advanced configuration that is dependent on your individual cloud environment. Zscaler MDR does not provide assistance with this setup. If you have any questions or encounter issues, we recommend reaching out to SentinelOne Support for guidance and to ensure your SentinelOne account is properly configured before integrating it with Zscaler MDR.

The Zscaler MDR platform provides links to the source EDR platform that make it easy to investigate noted entities and activities. For SentinelOne, you must follow these steps in order to be successfully redirected with the appropriate query parameters set when you click a link in Zscaler MDR.

1. Log in to the SentinelOne Management Console, open the user profile dropdown in the menubar, then click My User.

2. In the Feature Preferences section, make sure Change Deep Visibility Mode is set to “Enhanced.”
   

3. Navigate to the Enhanced Visibility page.
   

   Visiting this page will update your browser cookies to enable subsequent redirects from Zscaler MDR to SentinelOne.

Sensor performance, network communication issues, endpoint performance, or network communication issues can affect whether your Zscaler MDR endpoint count and SentinelOne endpoint count match up. It may also be possible, however unlikely, that there is some type of communication issue between the SentinelOne Server and Zscaler MDR. It’s always a good idea to check these numbers to ensure that Zscaler MDR is receiving telemetry from the number of endpoints you expect from SentinelOne.

To count active endpoints in Zscaler MDR:

1. Go to the Endpoints page in the Zscaler MDR portal.

2. In the search bar, enter last_checkin_time: with today’s date.
   

This gives you the number of endpoints that have checked in with Zscaler MDR so far today. You’ll use this number to compare to the number of endpoints being monitored in SentinelOne. Note that the Last Check In Time is in UTC when comparing your results to SentinelOne.

To count active endpoints in SentinelOne:

1. In the SentinelOne Management console, click Sentinels on the navigation menu and go to the Endpoints tab.

2. Click in the Select filters field, and then click View More Filters.

3. Deselect any default filters then select Connected to Management,

4. Click Back to filters. 

A new Connected to Management panel displays with metrics for Yes and No.

The Yes metric shows you the number of endpoints considered Connected to Management and actively checking in with the SentinelOne server. This is the number to compare to Zscaler MDR.

Troubleshooting:

If you notice a large disparity between the number of active endpoints in Zscaler MDR compared to SentinelOne, examine the endpoints in SentinelOne. Here are a few things to look for:

• Is the endpoint online?

• Is the Zscaler MDR sensor running on the endpoint?

• Is the Zscaler MDR sensor communicating with SentinelOne?

If you discover that a sensor isn’t communicating or isn’t connected to SentinelOne, review SentinelOne’s help documentation. To access the help documentation, log in to SentinelOne, click the question mark icon, and then select Help. If you need additional assistance, please submit a request with Zscaler MDR Support.

The Deep Visibility feature is what collects and sends endpoint data to SentinelOne, and by extension to Zscaler MDR. SentinelOne uses policy inheritance to control settings throughout the account/site/group structure. If you have a site or group that has policy inheritance disabled, then any changes made at the account level, like enabling Deep Visibility, will not be inherited.

To correct this, you’ll need to enable policy inheritance in SentinelOne.

1. In the SentinelOne Management console, click Sentinels on the navigation menu and go to the Policy tab.

2. In the Deep Visibility section, make sure Enable Deep Visibility is turned on then enable everything except Data Masking and Focused File Monitoring.
   

3. Click the Event Type Configuration link and enable all the options in the File section.
   

Note

Make sure Data Masking is disabled. Also, leaving any boxes unchecked under Event Type Configuration will trigger a status failure in Zscaler MDR.