Skip to main content
All SentinelOne integration capabilities

​
About

Stream SentinelOne threats and unified alerts into Sazabi as searchable log records. A Singularity Hyperautomation workflow in your SentinelOne console runs on each new or updated threat or alert and sends it to Sazabi with an HTTP Request action. Sazabi never holds a SentinelOne API token. Each record keeps the full threat or alert object, takes its time from the detection, maps confidence (threats) or severity (alerts) to a log level, and adds sentinelone.* attributes for the name, classification, status, analyst verdict, endpoint, and site. Deep Visibility telemetry (process, file, network, and registry events) and management console activity logs are not carried. SentinelOne exports Deep Visibility only through Cloud Funnel to your own storage bucket.

​
Prerequisites

  • A SentinelOne Management Console with Singularity Hyperautomation.
  • A console user who can create and activate Hyperautomation workflows.
  • Your Sazabi intake URL (shown above).

​
Set up in the dashboard

1

​
Create a workflow

In your SentinelOne Management Console, open Hyperautomation > Workflows and create a new workflow.
2

​
Add the trigger

Choose the alert or threat trigger, and narrow it to the sites, severities, or classifications you want in Sazabi.
3

​
Add an HTTP Request action

Add an HTTP Request action after the trigger:The public key is embedded in the URL’s hostname, so no authorization header is needed.
4

​
Save and activate

Save the workflow and activate it.

​
Set up with the CLI

You can also register the SentinelOne log source with the Sazabi CLI:
The command prints the intake URL for the new source. Paste the whole URL into the HTTP Request action’s URL field. Run sazabi log-sources get with the log source ID at any time to reprint the endpoint.

​
Verify

Run the workflow with a test alert from the workflow editor, or wait for the next matching threat. Open the Intake page in the Sazabi dashboard and confirm records from the SentinelOne source appear.

​
Troubleshooting

No records arriving — Check the workflow’s run history in Hyperautomation. If the workflow never ran, the trigger did not match; widen it or send a test alert. If it ran, confirm the HTTP Request action uses POST and the full Sazabi URL, including https://. HTTP 400 in the run — The body carried more than 1,000 records. Send one trigger object per run. Records arrive without SentinelOne time, severity, or attributes — A body that is not JSON still returns success. Sazabi keeps it as one raw record with the receive time and no sentinelone.* attributes. Make sure the body is the trigger’s JSON object rather than text that embeds it, and that Content-Type is application/json. HTTP 401 or 403 in the run — The URL’s key is wrong, belongs to another project, or was deleted. Create the log source again and update the action’s URL.

​
Further reading

Intake

See per-source ingestion volume and health in the Intake page.

Webhook Events

Send JSON from any other system with webhooks.