Integrate SentinelOne Cloud Funnel 2.0 with Red Canary

1. Login to your SentinelOne admin account. 

2. From the SentinelOne navigation menu, click Settings.

3. Click the Accounts tab, and then click the (action) next to the account being integrated with Red Canary.

   

4. In the edit account page, review the Add-ons section.

   1. If visible, select Cloud Funnel.

   2. If Cloud Funnel is not visible, submit a support case to SentinelOne to request that they make Cloud Funnel 2.0 visible in your account.

      

5. Click Save Changes.

Red Canary requires access to your SentinelOne account for our customer security operations team to provide quality service.

1. Login to your SentinelOne admin account.

2. From the SentinelOne navigation menu, select the account you want Red Canary to access.

3. Click SETTINGS.

4. Click the USERS tab.

5. Click Console Users.

6. Click the Actions dropdown.

7. Click Add New User.

   

8. For the Full Name field, enter Red Canary Access.

9. For the Email Address field, enter the email provided by Red Canary via email.

10. Click Next.

11. From the Access Level section, select the appropriate level of access, Site or Account.

12. Type and then select the account or site name that Red Canary is gaining access to.

    

13. From the viewer dropdown, select Admin.

    

14. Click Create User.

    Note: Once the service account is created, Red Canary will create an additional Viewer level service account for our Customer Security Operations (CSO) team. If you have purchased Active Remediation, Red Canary will also create an Incident Response (IR) Team level service account.

You will need three pieces of information in order to connect SentinelOne Cloud Funnel 2.0 to Red Canary.

1. Login to your SentinelOne admin account.

2. From your address bar, copy the URL, and then save your SentinelOne Management API Host. You’ll use this in a later step.

   Example: https://usea1-100-abc.sentinelone.net

3. From the SentinelOne navigation menu, click Sentinels.

   

4. Click the ACCOUNT INFO tab. You’ll use this in a later step.

5. Copy and then save the Account ID. You’ll use this in a later step.

   

6. From the SentinelOne navigation menu, click Settings.

7. Click your user profile dropdown, and then click My User.

8. Click the Options dropdown.

9. Click Generate API Token.

   

10. Copy and then save the API Token. You’ll use this in a later step.

11. Click Close.

Enter your SentinelOne credentials to configure telemetry streaming in Red Canary.

1. From your Red Canary homepage, click Integrations. If you do not see the required integration, click See all integrations.

   

2. In the search bar, type and then select SentinelOne with Cloud Funnel 2.0.

   

3. Click Configure.

   

4. Enter your SentinelOne Management Account ID from Step 3.5.

5. Enter your SentinelOne Management API Token from Step 3.10.

6. Enter your SentinelOne Management API Host from Step 3.2.

7. Select a SentinelOne Account Type. 

   • This will most likely be an Account Type of Account for most integrations. However, if the configured tenant is set up as a site level tenant, select Site. 

8. Click Save.

Note: API credentials expire every 30 days. Red Canary utilizes automation that updates the API for the SentinelOne telemetry integration as well as the Singularity alert source integration.