Triage SentinelOne Threat Alerts Crate
Last updated
Was this helpful?
Last updated
Was this helpful?
If you’re new to Crates, read through our introductory Crate documentation here. Find the Triage SentinelOne Threat Alerts Crate in our Crate Marketplace.
Our Triage SentinelOne Tickets Crate streamlines the process of matching SentinelOne alert tickets with their corresponding companies in ConnectWise PSA. It automatically scans ticket subjects for SentinelOne alert patterns, identifies the company via SentinelOne API, and links it to the correct company in ConnectWise PSA.
Quickly identify which client company is affected by a SentinelOne security alert
Reduce response time for security incidents by eliminating manual lookup processes
Ensure security alerts are properly routed to the correct company in ConnectWise PSA
Improve security incident tracking by maintaining accurate company associations
Save time for technicians who would otherwise need to manually cross-reference devices
An active SentinelOne integration with Rewst
ConnectWise PSA integration with Rewst
Navigate to Crates > Crate Marketplace in the Rewst platform.
Search for Triage SentinelOne Tickets Crate.
Click on the Crate tile to begin unpacking.
Click Unpack Crate to complete the installation.
Click Continue.
Configure Trigger Criteria. Trigger criteria should trigger the workflow when Entity.summary starts with SentinelOne - .
Click Unpack.
Create a test ticket in ConnectWise PSA with a subject line matching the SentinelOne alert pattern-e.g., SentinelOne - Malware detected on DEVICE-NAME-123.
After creating the test ticket, the workflow will automatically trigger based on the trigger criteria you set during setup. The workflow trigger monitors for new tickets with SentinelOne alert patterns in the subject line.
To verify the workflow executed properly, navigate to Automations > Results in the Rewst platform.
Locate the most recent workflow result with workflow named "Triage SentinelOne Tickets" in your result list.
Click the > next to the workflow to open the workflow dialog page.
This will open the result details page.
Navigate back to ConnectWise PSA and verify that the ticket has been associated with the correct company and contains any additional information added by the workflow.
Confirm that the trigger criteria is correct for your environment.
For tickets that aren't being processed, confirm that the ticket subject follows the expected SentinelOne alert pattern.
Check the workflow result logs for any API errors that might indicate permission issues with your integrations.
Got an idea for a new Crate? Rewst is constantly adding new Crates to our Crate Marketplace. Submit your idea or upvote existing ideas here in our Canny feedback collector.
