What is SentinelOne Singularity XDR? #
SentinelOne Singularity XDR (formerly SentinelOne) provides detection and response capabilities across multiple security layers, including endpoint, cloud, identity, network, and mobile and provides analytics and automated responses.
Why Should You Use the SentinelOne Singularity XDRConnector? #
The SentinelOne Singularity XDR connector provides visibility into the assets in your environment. You can use this visibility to:
-
ensure assets are managed per your security policies
-
derive relationships between assets, users, applications, and data
How Does This Connector Work? #
Meridian executes read-only requests to the SentinelOne Singularity REST API and ingests only meta-data about SentinelOne Singularity XDR devices. Meridian does not retrieve any data stored on your assets.
Configuring the Connector in Meridian #
| Field | Description | Example |
|---|---|---|
| URL | The URL for the SentinelOne API. | https://<sentinelone> domain>/web/api/v2.1 |
| Filter Application | SentinelOne assigns a risk level to applications (low, medium, high, critical). If this toggle is “on”, Meridian ingests data only from applications that have an assigned risk level By default, this toggle is “off” and Meridian ingests data from all applications. | Off |
| Data Lookback in Days | Number of days’worth of data to ingest. Default value is 30. If you use the default value, the connector ingests data from today, and the past 29 days. | 30 |
| API Token | An API token for a SentinelOne account that has read access to API data. Leave blank if you entered values in the Username field and the Password field. | abcdefg12345678 |
| Username | Username for a SentinelOne Console User who has read access to the SentinelOne APIs. Leave blank if you entered a value in the API Token field. | abcdefg12345678 |
| Password | Password for a SentinelOne Console User who has read access to the SentinelOne APIs. Leave blank if you entered values in the Username field and the Password field. | abcdefg12345678 |
Source Documentation #
Creating Credentials #
- To create a console user account in SentinelOne for Meridian, see https://community.sentinelone.com/s/article/000005231.
- To generate an API token for the Meridian connector, see Generating API tokenshttps://community.sentinelone.com/s/article/000005262
