Imports detected threats, agent inventory, alerts, activities, IOCs, sites and groups, installed applications, STAR custom rules and exclusions from your SentinelOne console.
For the general flow of adding a source, see Connect Data Sources.
SentinelOne account with Admin or Service User role
URL of your SentinelOne instance (e.g., https://yourcompany.sentinelone.net)
Sign in to your SentinelOne console
Avatar top right → My User
API Token section → Generate
Copy the displayed token immediately
Settings → Users → Service Users
Actions → Create New Service User
Name: HARVEN, role: Viewer
Scope: your whole account, or every site you want to read. A Service User limited to one site only returns that site's data
Copy the generated API token
Field | Where to find it |
|---|---|
SentinelOne instance URL | Address bar of your SentinelOne console |
API Token | SentinelOne → My User → API Token |
threats — Detected threats: Identification (threat_name, classification, mitigation_status), Context (agent_computer_name, file_sha256, in_quarantine)
agents — Protected agents: Identification (computer_name, os_type, agent_version), Status (is_active, is_infected, threat_count, scan_status), Network (last_ip_to_mgmt, external_ip)
alerts — Security alerts: Detection (rule_name, severity, source_process_name)
activities — Activity log: Activity (activity_type, description, user_email)
iocs — Indicators of compromise: IOC (value, ioc_type, source, valid_until)
sites — Sites and their configuration: Identification (site_name, site_type, state, account_name), Licensing (suite, total_licenses, active_licenses, expiration), Coverage (total_agents, health_status)
groups — Agent groups: Identification (group_name, group_type, site_name), Configuration (is_default, inherits_policy, total_agents)
applications — Applications installed on managed endpoints: Application (name, publisher, version, installed_at), Context (agent_computer_name, risk_level, signed)
rules — STAR custom detection rules: Rule (rule_name, severity, status, query_type), Activity (generated_alerts, network_quarantine, expiration_date)
exclusions — Items excluded from scanning and detection: Exclusion (exclusion_type, value, os_type, mode), Scope (scope, creator)
Need help? Contact [email protected].
