SentinelOne V2 (via Codeless Connector Framework)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index

Attribute Value
Connector ID SentinelOneV2Connector
Publisher Microsoft
Used in Solutions SentinelOne
Collection Method CCF
Connector Definition Files SentinelOneV2_ConnectorDefinition.json
DCR Definition Files SentinelOneV2_DCR.json
CCF Configuration SentinelOneV2_PollerConfig.json
CCF Capabilities APIKey, Paging, POST
Microsoft Learn View on Learn

The SentinelOne V2 data connector ingests Activities, Agents, Groups and Threats logs from the SentinelOne REST API, and security alerts from the SentinelOne Unified Alert Management (UAM) GraphQL API, into Microsoft Sentinel. It is built on the Microsoft Sentinel Codeless Connector Platform and uses DCR-based ingestion-time transformations. See: SentinelOne UAM GraphQL API

Tables Ingested

This connector ingests data into the following tables:

Table Transformations Ingestion API Lake-Only
OneActivities_CL ? ✓ ?
OneAgents_CL ? ✓ ?
OneAlertsV2_CL ? ✓ ?
OneGroups_CL ? ✓ ?
OneThreats_CL ? ✓ ?

💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.

Permissions

Resource Provider Permissions:

Setup Instructions

⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.

1. Connect SentinelOne to Microsoft Sentinel

Configure your SentinelOne API connection. Each instance corresponds to a single SentinelOne Management URL + API Token.

Configuration steps for the SentinelOne API

Follow the instructions below to obtain the credentials. Alerts are collected via the SentinelOne Unified Alert Management GraphQL API.

1. Retrieve SentinelOne Management URL

1.1. Log in to the SentinelOne Management Console with Admin user credentials. 1.2. In the Management Console copy the URL link without the URL path.

2. Retrieve API Token

2.1. Log in to the SentinelOne Management Console with Admin user credentials. 2.2. In the Management Console, click Settings. 2.3. In Settings view click on USERS. 2.4. In the USERS page click on Service Users -> Actions -> Create new service user. 2.5. Choose Expiration date and scope (by site) and click on Create User. 2.6. Once the Service User is created copy the API Token from the page and press Save.

3. Connect new instances

To enable the SentinelOne connector for Microsoft Sentinel, click the Add new instance button, fill in the required information in the context pane and click on Connect. Connector Management Interface

This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.

📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:

➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).

🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.

💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.

SentinelOne connector

Add new instance

When you click the "Add new instance" button in the portal, a configuration form will open. You'll need to provide:

💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index