Integrating with SentinelOne

Overview

Blumira integrates with SentinelOne to detect cybersecurity threats across your environment, combining SIEM log analysis and AI-powered investigation to provide automated or actionable response.

Note: Data collection begins after configuring a new SentinelOne Cloud Connector and does not include past logs generated before establishing the connection.

Before you begin

Before setting up a SentinelOne Cloud Connector, you must gather the following authentication credentials:

• API Token
• Management URL
• Site ID
  Note: The Site ID value is different from the Site Token. Ensure that you copy the Site ID.

We recommend using a SentinelOne service user account for the integration instead of a console user account to generate the API Token. Console users' API tokens expire after 30 days, whereas you can set the desired expiration for a service account.

Gathering your SentinelOne credentials

To gather the SentinelOne credentials, do the following:

1. Log in to the SentinelOne Management Console.
2. Navigate to Settings > Users > Service Users.
3. Under Actions, click Create New Service User.
   

4. In the Create New Service User window, type a name and optional description for the service user, then select an expiration date for the API token.

   

5. Click Next.
6. In the Select Scope of Access window, set the appropriate Access Level for the service user [Account | Site].
   
7. Copy and save the API Token for later steps.
8. Click Create User.
9. Copy and save your organization’s Management URL, which is the base URL specific to your organization when you are logged in to SentinelOne.
   Example: https://usea1-partners.sentinelone.net
10. To obtain the Site ID, navigate to Settings > Sites, click a site name, and then click Site Info.
11. At the top of the window, next to the account name, copy the Site ID for use in the Blumira Cloud Connector.
12. (Optional) In very rare instances, the Account ID is also needed to improve Blumira's log collection. To obtain the Account ID, navigate to Sentinels > Account Info, then copy the Account ID. If you are unsure, leave this field blank in the Blumira Cloud Connector.

Configuring the Blumira Cloud Connector

To configure the Blumira Cloud Connector and begin logging, do the following:

1. In Blumira, navigate to Ingestion > Cloud Connectors.
2. Click + Add Cloud Connector.
3. In the Available Cloud Connectors window, select the connector you want to add.
4. In Cloud Connector Name, type a name that will help you identify the integration.
5. In the remaining fields, enter the credentials you gathered in the previous steps.
6. Click Connect.