SentinelOne — Integration Setup

Prerequisites

SentinelOne Singularity subscription (Complete, Commercial, or Enterprise)
Site or Account admin access to create API users
CMDash Essentials tier or above

Step 1: Create an API Token

Log in to your SentinelOne management console (https://<your-console>.sentinelone.net).
Go to Settings → Users → API Tokens.
Click Generate New Token.
Name: CMDash Integration.
Scope: Site (or Account if you want cross-site visibility).
Expiration: 180 days (rotate before expiry).
Copy the generated token — SentinelOne only shows it once.

Step 2: Connect in CMDash

Navigate to Integrations in your CMDash dashboard.
Find SentinelOne and click Connect.
Enter:
- Management Console URL (e.g., https://usea1-partners.sentinelone.net)
- API Token
Click Save & Test Connection.

What Syncs

Data Type	API	Sync Frequency
Agents (endpoints)	`/web/api/v2.1/agents`	Every 4 hours by default
Threats (incidents)	`/web/api/v2.1/threats` (created_at filter)	Every 4 hours by default
Patch status	Derived from `pendingUpdates` field on agent response	Every 4 hours by default

Permissions Required

The API token inherits the permissions of the user that created it. The token needs Read access to:

Agents (site-scoped)
Threats (site-scoped)

CMDash does not perform any write operations against SentinelOne.

Troubleshooting

HTTP 401 on health check: token has expired or was revoked. Regenerate and re-connect.
Sync returns 0 endpoints: confirm the token's site scope covers the sites you want visibility into. A user scoped to a single site will not see agents in other sites.
Rate limiting: SentinelOne's Admin API has a soft limit of 5 requests per second per token. CMDash paginates at 1000 agents per page, so a 10 000-agent tenant takes ~10 requests total.

Rate Limits & Sync Behavior

Setting	Value
Sync frequency	Every 4 hours by default (configurable per integration)
First sync	Historical data pulled on initial connection (agents, threats, and patch status visible to the token's scope)
Rate limit handling	Per-(tenant, provider) token bucket; requests are batched and rate-limited automatically
429 handling	Exponential backoff triggered; sync rescheduled automatically
Vendor rate limit	1000 req/min (generous allowance)
CMDash batch size	250 agents per request
Failed sync retry	Dead-letter queue — see docs/developers/dead-letter.md

SentinelOne's rate limits are among the most generous of any supported vendor. CMDash batches agent queries in chunks of 250 and pages through large fleets efficiently. Even for very large environments (50,000+ agents), the full sync typically completes in minutes, well inside the 4-hour sync window. In the rare event of a 429, CMDash applies exponential backoff and reschedules the affected sync slice.

Credential Rotation

SentinelOne API tokens expire based on the expiry period you configure when generating the token. CMDash recommends a 180-day expiry with a calendar reminder set 30 days before expiry.

To rotate before expiry:

Log in to your SentinelOne management console.
Go to Settings → Users → API Tokens (or User → API Token depending on console version).
Click Generate New Token (or Regenerate on the existing token).
Set the expiry to 180 days and copy the new token — it is only shown once.
In CMDash: Settings → Integrations → SentinelOne → Edit.
Enter the new API Token and click Save before the old token expires to avoid a sync gap.

Note: CMDash will display a warning banner when credentials are within 30 days of expiry if SentinelOne exposes the expiry timestamp in its API response. Set a calendar reminder as a backup regardless.

Multiple Instances / Multi-Site

SentinelOne supports two scoping models that affect how many CMDash integrations you need:

Scope	Coverage	Recommended?
Account scope	All sites under the account	Yes — one CMDash integration covers everything
Site scope	A single site only	Use only if you need per-site credential isolation

Account scope (recommended): Generate the API token from an Account-level admin user. One CMDash integration connection covers all sites under that account, and data from all sites is merged in the compliance dashboard.

Site scope: If you must isolate credentials per site, add one CMDash integration per site:

In CMDash: Settings → Integrations → Add Integration → SentinelOne.
Enter the site-scoped API token and the management console URL.
Give the connection a descriptive name (e.g., SentinelOne - Site: London, SentinelOne - Site: NYC).
Repeat for each site.

Compliance Framework Coverage

The SentinelOne integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.

Framework	Control	Description
PCI DSS	10.2	Event monitoring — threat detections and agent activity logs
PCI DSS	11.5	Intrusion detection — SentinelOne threat events mapped to IDS/IPS evidence
HITRUST	09.ab	Monitoring system use — agent telemetry and detection events
HITRUST	09.v	Information security incident management — threat incidents and response actions
CMMC L2	SI.1.210	System monitoring — continuous endpoint monitoring via SentinelOne agents
CMMC L2	IR.2.092	Incident reporting — threat incidents and escalation records mapped to IR evidence
SOC 2	CC7.2	Anomalies — behavioral threat detections mapped to anomaly identification evidence
SOC 2	CC7.3	Incident response — threat response actions and remediation records