Import Data from SentinelOne

Mondoo can import data from SentinelOne and combine it with your Mondoo findings. The unified view gives you Mondoo's security visualization, prioritization, and ticketing on top of SentinelOne vulnerability data.

Prerequisites

• Editor or Owner access to the Mondoo space
• A SentinelOne Singularity account with administrator privileges

Create a SentinelOne service user

Mondoo authenticates with a SentinelOne service user (a non-human account with an API token).

1. Log into the SentinelOne management console as an administrator.

   

2. In the side navigation, select Settings > USERS > Service Users.

   

3. Select Actions > Create New Service User.

   

4. Give the user a name and description that identify it as Mondoo's, then select Next.

   

5. Choose the account(s) (not sites) you want Mondoo to access. Leave Viewer selected as the role.

6. Select Create User.

   

   SentinelOne shows the API token. Copy it; you need it in the next section.

Add a SentinelOne integration

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations. In the top right, select + INSTALL. On the integrations page, find the integration you want by browsing or searching by name:

1. Under Third-Party Data, select SentinelOne.

   

2. In Choose an integration name, enter a name for the integration.

3. In Enter the host URL, enter the base URL for your SentinelOne management console. For example, if you access the console at https://my-company.sentinelone.net/dashboard, enter https://my-company.sentinelone.net.

4. In Provide the SentinelOne API token, paste the token you copied.

5. Select START IMPORTING.

Manage this integration

To open an existing integration, navigate to the space, select Integrations > All Integrations in the side navigation, choose the integration type, then select the integration.

From the integration detail page, you can:

• Edit settings. Select the edit (pencil) icon.
• Trigger an immediate import. Select SCHEDULE NOW.
• Pause or resume imports. Select the ellipsis (...) menu, then Pause Imports or Resume Imports.
• Remove the integration. Select the trash can icon and confirm.