SentinelOne Integration

Create API Token

Generate an API token in SentinelOne with required permissions.

                # Create API Token in SentinelOne:
# 1. Log in to SentinelOne Management Console
# 2. Navigate to Settings → Users
# 3. Select your user or create a service account
# 4. Go to Options → API Token Operations
# 5. Click "Generate API Token"
# 6. Copy the generated token

# Required API permissions:
# - Remote Script Orchestration
# - Deep Visibility
# - Custom Detection Rules (optional)
# - Threat Intelligence (for correlation)

# Console URL depends on your region:
# - US East: https://usea1.sentinelone.net
# - US West: https://uswe1.sentinelone.net
# - EU: https://euce1.sentinelone.net
# - APAC: https://apac1.sentinelone.net
              

Test API Connection

Verify the API token and console URL are working correctly.

                # Test SentinelOne API connection
curl -X GET "https://usea1.sentinelone.net/web/api/v2.1/system/status" \
    -H "Authorization: ApiToken YOUR_API_TOKEN" \
    -H "Content-Type: application/json"

# Get account info
curl -X GET "https://usea1.sentinelone.net/web/api/v2.1/accounts" \
    -H "Authorization: ApiToken YOUR_API_TOKEN" \
    -H "Content-Type: application/json"

# Test event ingestion (Custom Events API)
curl -X POST "https://usea1.sentinelone.net/web/api/v2.1/cloud-detection/events" \
    -H "Authorization: ApiToken YOUR_API_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "data": [{
        "eventType": "Custom",
        "eventSource": "DBaudit",
        "customFields": {"test": "event"}
      }]
    }'
              

Configure in DB Audit

Add the SentinelOne integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select SentinelOne as the provider
4. Enter your console URL and API token
5. Enter your account ID and optional site ID
6. Select event types to forward
7. Test the connection and save

Create Custom Detection Rules (Optional)

Create custom detection rules for database security threats.

                // SentinelOne Custom Detection Rule
// Singularity → Custom Detection Rules → Add Rule

Rule Name: DB Audit - Suspicious Data Exfiltration
Description: Detects queries returning large amounts of sensitive data

// Query
EventType = "Custom"
AND EventSource = "DBaudit"
AND CustomFields.action_type = "SELECT"
AND CustomFields.rows_affected > 10000
AND CustomFields.contains_pii = true

// Rule Configuration
Severity: High
MITRE ATT&CK:
  - Tactic: Collection (TA0009)
  - Technique: Data from Information Repositories (T1213)

// Response Actions (Optional)
- Create Threat
- Notify SOC Team
- Isolate endpoint (if client IP matches agent)

// Alert Details
Include in alert:
- CustomFields.actor_user
- CustomFields.database
- CustomFields.client_ip
- CustomFields.rows_affected