SentinelOne: Inventory Discovery

The SentinelOne integration reads the assets from your SentinelOne management console and brings them into Connect's Inventory, one item per asset with its IP address and tags. A first discovery runs as soon as you provision the account, and it re-runs automatically every day.

This integration only reads. Nothing is created, changed, or deleted in SentinelOne.

Before you start

Prerequisite	Why it's needed	Where to check in the console
The URL of your management console, for example https://example.sentinelone.net	Every API call goes to it	Your browser's address bar when you're signed in
An API token for a user or service user that can view assets	Discovery lists assets and their details	Generated for the user or service user under Settings > Users in the console

Read-only access is enough. A service user is the better choice for an integration: its token keeps working when people leave, and it can be given a longer expiry than a personal token.

Set up a SentinelOne account

1. In Connect, go to Settings > Accounts and add a new account.
2. Cloud Provider: SentinelOne. Give it an ID (any identifier that's unique among your accounts; the console URL's hostname works well), a name, and a project.
3. Save. You land on the Provision page. Fill in:
   • API Base URL: the console URL, with no path, for example https://example.sentinelone.net.
   • API Token: the token you generated. It must be re-typed on every save of this page; see Passwords and tokens are never shown back to you.
4. Save. The first discovery starts on its own.

What gets discovered

Each asset becomes one inventory item of type Asset, sourced from SentinelOne:

Asset field	Where it lands
Name	The item's name
IP address	The item's IP addresses (one per asset)
Tags and cloud tags	The item's tags, combined

Assets are matched between runs by their SentinelOne ID. An asset that no longer appears in the console is removed on the next run.

Verify it landed

What to check	Where to look
The account has no errors	Settings > Accounts: no warning icon on the SentinelOne account, and its Provision page shows no Resource Errors
The item count	Integrations in the main navigation: the SentinelOne row is Active and its Items count roughly matches the asset inventory in your console
The items themselves	Inventory > Resources, filtered by Vendor > SentinelOne. Open one: its IP and tags should match the asset in the console

Details and edge cases

Large fleets take longer to discover. Allow extra time for the first run on a console with many thousands of assets.

API tokens expire. SentinelOne tokens have an expiry set in the console. When the token expires, the next discovery fails with an authentication error and the account shows a Resource Errors alert. Generate a new token and re-enter it on the Provision page. Setting a long expiry on a service user's token avoids the interruption.

For common issues, see Troubleshooting.

SentinelOne documentation

SentinelOne's API and console documentation is published inside your management console under Help, and on the SentinelOne support portal, which requires a customer login. The relevant topics are Generating API Tokens and the Asset Inventory section of the API reference.