> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> Forward SentinelOne threats and alerts to your Sazabi intake URL from a Singularity Hyperautomation workflow.

[All SentinelOne integration capabilities](https://docs.sazabi.com/catalogs/integrations/sentinelone)

## About

Stream SentinelOne threats and unified alerts into Sazabi as searchable log records. A Singularity Hyperautomation workflow in your SentinelOne console runs on each new or updated threat or alert and sends it to Sazabi with an HTTP Request action. Sazabi never holds a SentinelOne API token.

Each record keeps the full threat or alert object, takes its time from the detection, maps confidence (threats) or severity (alerts) to a log level, and adds `sentinelone.*` attributes for the name, classification, status, analyst verdict, endpoint, and site.

Deep Visibility telemetry (process, file, network, and registry events) and management console activity logs are not carried. SentinelOne exports Deep Visibility only through Cloud Funnel to your own storage bucket.

## Prerequisites

* A SentinelOne Management Console with **Singularity Hyperautomation**.
* A console user who can create and activate Hyperautomation workflows.
* Your Sazabi intake URL (shown above).

## Set up in the dashboard

**Step 1**

### Create a workflow

In your SentinelOne Management Console, open **Hyperautomation > Workflows** and create a new workflow.

**Step 2**

### Add the trigger

Choose the alert or threat trigger, and narrow it to the sites, severities, or classifications you want in Sazabi.

**Step 3**

### Add an HTTP Request action

Add an **HTTP Request** action after the trigger:

| Field | Value |
| - | - |
| Method | `POST` |
| URL | Your Sazabi intake URL |
| Header | `Content-Type: application/json` |
| Body | The trigger's whole threat or alert object as JSON |

The public key is embedded in the URL's hostname, so no authorization header is needed.

**Step 4**

### Save and activate

Save the workflow and activate it.

## Set up with the CLI

You can also register the SentinelOne log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md):

```bash theme={"system"}
sazabi log-sources create sentinelone
```

The command prints the intake URL for the new source. Paste the whole URL into the HTTP Request action's URL field. Run `sazabi log-sources get` with the log source ID at any time to reprint the endpoint.

## Verify

Run the workflow with a test alert from the workflow editor, or wait for the next matching threat. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm records from the **SentinelOne** source appear.

## Troubleshooting

**No records arriving** — Check the workflow's run history in Hyperautomation. If the workflow never ran, the trigger did not match; widen it or send a test alert. If it ran, confirm the HTTP Request action uses `POST` and the full Sazabi URL, including `https://`.

**HTTP 400 in the run** — The body carried more than 1,000 records. Send one trigger object per run.

**Records arrive without SentinelOne time, severity, or attributes** — A body that is not JSON still returns success. Sazabi keeps it as one raw record with the receive time and no `sentinelone.*` attributes. Make sure the body is the trigger's JSON object rather than text that embeds it, and that `Content-Type` is `application/json`.

**HTTP 401 or 403 in the run** — The URL's key is wrong, belongs to another project, or was deleted. Create the log source again and update the action's URL.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Webhook Events](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/webhook-events.md)
>
> Send JSON from any other system with webhooks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.