> For the complete documentation index, see [llms.txt](https://docs.rewst.help/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rewst.help/rewst-documentation/documentation/integrations/integration-guides/sentinelone-integration-setup.md).

# SentinelOne integration

This document outlines the requirements and setup for the SentinelOne integration.

{% hint style="info" %}
 If you’re new to integrations in Rewst, read through our introductory integration documentation [here](https://docs.rewst.help/documentation/integrations).
{% endhint %}

## What does the SentinelOne integration do?

Our SentinelOne integration enables the automation of endpoint protection. Use the SentinelOne API within Rewst workflows to manage accounts, agents, forensics, and threats.

## Set up the SentinelOne integration

### Set up steps in SentinelOne

1. Log in to the SentinelOne management console.
2. Navigate to **Policies and Settings > Service Users**.
3. Click **New Service User.**
4. Set a name and an expiration date for the account. We recommend setting the expiration years in the future to minimize the number of times you'll need to reauthenticate the integration within Rewst.
5. Assign the user the **Account** scope. 
   1. **Viewer** scope is enough permission for read-only automations like our Billing Count Report Crate. 
   2. Any action that changes something— scanning, isolating or decommissioning agents, creating or updating sites— will require the Admin scope; for this reason we recommend it over Viewer.
6. Click **Create Service User**.
7. Copy the API token information. Save it in a secure location. You'll need this information for further set up steps in Rewst.

### Set up steps in Rewst

1. Navigate to **Integrations** in the left side menu of your Rewst platform.
2. In the Integrations page, search for the `SentinelOne` integration.
3. Click on the integration tile to launch the configuration setup dialog.
4. Choose from either Production or Demo Mode for the setup of your integration:
   1. **Production**: Connect with real credentials for live data
   2. **Demo Mode**: Explore the integration with simulated mock responses
5. Click **Next: Configure and Authenticate**.
6. Select **+ Create New Credential from the Credential** drop-down selector.
7. Enter the information copied from SentinelOne into the relevant fields:
   1. **Console hostname**: TheSentinelOne management console hostname, without https\://, e.g. `usea1-partners.sentinelone.net`.
   2. **API Token**
8. Click **Save Credential**.
9. Click **Next: Confirm**.
10. Click **Install Integration**. The integration will now appear in the top Connected section of your Integrations page. 
11. Click on the installed integration. Scroll down to the Org Mappings section of the configuration page and complete organization mapping as needed.

{% hint style="success" %}
Got an idea for a new Integration? Rewst is constantly adding new integrations to our integrations page. Submit your idea or upvote existing ideas here in our [Canny feedback collector](https://rewst.canny.io/integrations).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.rewst.help/rewst-documentation/documentation/integrations/integration-guides/sentinelone-integration-setup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.