TABLE OF CONTENTS

• 1.0 Overview
• 2.0 Configuration (via API)
• 3.0 Configuration (TCP over TLS)

1.0 Overview

ADR can ingest logs from SentinelOne using an API token or by sending syslogs to the ADR CCE VM.

2.0 Configuration (via API)

1. In the SentinelOne management console, go to Settings and then click Users.
2. Click on the Admin that will be used to generate the API token.
3. Click Generate next to API token.
4. Click on the Copy API token link.
    
5. On the APE dashboard, navigate to Settings -> Provisioning -> Add-on Configuration.
    
6. Click the Add button, scroll down to SentinelOne, then click the Next button.
   
    
7. Fill in the fields as follows, then click the Save button.
   • Device: Use the device type 'SentinelOne'.
   • Name: Choose an arbitrary name. It can be the same as the Device type.
   • CCE Host: Enter the IP address of your CCE.
   • Access ID/ User Name: Leave blank.
   • Password/Secret Key: Enter the API token previously copied in step 4.
   • Config: Use a JSON formatted string:
     {"host": "<your_management_url>", "account_type": "<user_account_type>"}
     • <your_management_url>: Enter your SentinelOne management URL (without https://).
     • <user_account_type>: The value can be either “service” or “console”. “console” is the default if none provided.