SentinelOne

Integrate SentinelOne for autonomous endpoint protection and AI-driven threat detection

SentinelOne is an autonomous cybersecurity platform that provides AI-powered prevention, detection, and response across endpoints, containers, and cloud workloads. Connecting SentinelOne to Harmony enables automated threat response, intelligent security operations, and seamless incident management for comprehensive endpoint protection.

What the SentinelOne integration enables

Capability	Description
Threat Detection	Monitor and respond to security threats across all endpoints
Device Monitoring	Track SentinelOne agent status and protection state
Real-Time Alerts	Receive and route security alerts to appropriate teams
Deep Links	Navigate directly from a managed device in Harmony to its corresponding entry in the SentinelOne console

Prerequisites

• SentinelOne Account: Active subscription with Management Console access
• API Token: Generated with appropriate permissions
• Harmony Account: Active Harmony workspace

Connect SentinelOne to Harmony

Step 1: Create API Token in SentinelOne

1. Log in to SentinelOne Management Console
2. Navigate to Settings > Users
3. Click Actions > Create API Token
4. Configure API user:

   • Name: "Harmony Integration"
   • Role: Viewer (or custom role with read permissions)
5. Click Create and copy the API Token

Step 2: Navigate to Integrations

1. Log in to your Harmony dashboard
2. Go to Settings > Integrations
3. Find SentinelOne under EDR and click Connect

Navigate to SentinelOne integration in Harmony dashboard

Step 3: Enter API Credentials

1. Enter your Base URL (e.g., https://tenant.sentinelone.net)
2. Enter your API Key
3. Click Connect

Enter SentinelOne credentials to connect

What Harmony Syncs

From SentinelOne:

• Detected threats with classification and severity
• Agent status, version, and health metrics
• Endpoint information and network details
• Device isolation status
• Security events and agent actions
• Quarantined files
• Remediation and rollback actions
• Deep Visibility telemetry data

Deep Links to SentinelOne

When a device in Harmony is linked to your SentinelOne EDR integration, Harmony automatically generates a direct URL to that device's entry in your SentinelOne console. Clicking the link opens the SentinelOne workstations view pre-filtered by the device's serial number, so you can jump straight to the relevant endpoint details without searching manually.

This works the same way as the existing deep-link support for CrowdStrike, giving teams that use SentinelOne the same seamless cross-platform navigation experience.

To use deep links:

1. Open a managed device record in Harmony's Asset Management view.
2. If the device is associated with a connected SentinelOne integration, a View in SentinelOne link appears in the device details panel.
3. Click the link to open the SentinelOne workstations view filtered to that device.

Use Cases

Autonomous Threat Response

Fully automated malware detection, containment, and remediation

Ransomware Protection

Rapid isolation and rollback response to ransomware attacks

Agent Health Management

Proactive monitoring and maintenance of endpoint protection agents

Threat Hunting

AI-assisted investigation and IOC queries across all endpoints

Security Operations Workflows

Bring SentinelOne endpoint detection and response signals directly into your Harmony workflows, enabling support and security teams to respond to alerts and incidents faster without switching between platforms.