> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/edr/sentinelone.md).
# SentinelOne
SentinelOne is an autonomous cybersecurity platform that provides AI-powered prevention, detection, and response across endpoints, containers, and cloud workloads. Connecting SentinelOne to Harmony enables automated threat response, intelligent security operations, and seamless incident management for comprehensive endpoint protection.
#### What the SentinelOne integration enables
| Capability | Description |
| ----------------- | -------------------------------------------------------------------------------------------------------- |
| Threat Detection | Monitor and respond to security threats across all endpoints |
| Device Monitoring | Track SentinelOne agent status and protection state |
| Real-Time Alerts | Receive and route security alerts to appropriate teams |
| Deep Links | Navigate directly from a managed device in Harmony to its corresponding entry in the SentinelOne console |
#### Prerequisites
* **SentinelOne Account**: Active subscription with Management Console access
* **API Token**: Generated with appropriate permissions
* **Harmony Account**: Active Harmony workspace
#### Connect SentinelOne to Harmony
**Step 1: Create API Token in SentinelOne**
1. Log in to SentinelOne Management Console
2. Navigate to **Settings** > **Users**
3. Click **Actions** > **Create API Token**
4. Configure API user:
* **Name**: "Harmony Integration"
* **Role**: Viewer (or custom role with read permissions)
5. Click **Create** and copy the **API Token**
**Step 2: Navigate to Integrations**
1. Log in to your Harmony dashboard
2. Go to **Settings** > **Integrations**
3. Find **SentinelOne** under **EDR** and click **Connect**
**Step 3: Enter API Credentials**
1. Enter your **Base URL** (e.g., `https://tenant.sentinelone.net`)
2. Enter your **API Key**
3. Click **Connect**
#### What Harmony Syncs
**From SentinelOne:**
* Detected threats with classification and severity
* Agent status, version, and health metrics
* Endpoint information and network details
* Device isolation status
* Security events and agent actions
* Quarantined files
* Remediation and rollback actions
* Deep Visibility telemetry data
#### Deep Links to SentinelOne
When a device in Harmony is linked to your SentinelOne EDR integration, Harmony automatically generates a direct URL to that device's entry in your SentinelOne console. Clicking the link opens the SentinelOne workstations view pre-filtered by the device's serial number, so you can jump straight to the relevant endpoint details without searching manually.
This works the same way as the existing deep-link support for CrowdStrike, giving teams that use SentinelOne the same seamless cross-platform navigation experience.
To use deep links:
1. Open a managed device record in Harmony's Asset Management view.
2. If the device is associated with a connected SentinelOne integration, a **View in SentinelOne** link appears in the device details panel.
3. Click the link to open the SentinelOne workstations view filtered to that device.
#### Use Cases
Autonomous Threat Response
Fully automated malware detection, containment, and remediation
Ransomware Protection
Rapid isolation and rollback response to ransomware attacks
Agent Health Management
Proactive monitoring and maintenance of endpoint protection agents
Threat Hunting
AI-assisted investigation and IOC queries across all endpoints
Security Operations Workflows
Bring SentinelOne endpoint detection and response signals directly into your Harmony workflows, enabling support and security teams to respond to alerts and incidents faster without switching between platforms.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.harmony.io/integrations/edr/sentinelone.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.