# SentinelOne integration

### Create Integration In Rezonate

Get your Webhook authentication Rezonate, this can be done via the Integrations Interface or Prelude CLI. Save generate-webhook output to be used in the following steps. To generate the webhook:

* Click on the settings button on the top right menu.
* Click on the Integration panel in Rezonate and then "New Integration". 
* Select S1 Integration and click Connect.

<figure><img src="https://2355086414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIkSba0W4HlnmPJ93gVOS%2Fuploads%2FnJuXNZobDcSOoowLLQGL%2Fimage.png?alt=media&#x26;token=d069f822-defb-4d92-b0bf-09b90e2c169c" alt=""><figcaption></figcaption></figure>

* Select a name for the new integration (it can be any name) and click Save.
* Take note of the webhook URL, we will use it in the next step.

  <figure><img src="https://2355086414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIkSba0W4HlnmPJ93gVOS%2Fuploads%2Fx6luyMI7TROTwr5y9C09%2Fimage.png?alt=media&#x26;token=2bc3b4d1-869b-403c-adb6-46cb7659a3ba" alt=""><figcaption></figcaption></figure>

### Create Webhook Destination in S1

<figure><img src="https://2355086414-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIkSba0W4HlnmPJ93gVOS%2Fuploads%2FAprS7mBn5mC2ZkzpRvYs%2Fimage.png?alt=media&#x26;token=e537bbd1-ec31-4e89-bbca-10a641ea4b2b" alt=""><figcaption></figcaption></figure>

* Select Singularity XDR Webhook, and click Configure.
* Click and expand the dropdown menu:
  * Select the box under **Response Actions**: **Make "Hooks" available as "Manual Response Actions" from Threats**
  * Select the Name for the configuration.
  * Select  **"Options for triggering"  and** Paste the webhook created in Step 1 to the **URL field**
  * Select POST in **Action,** and choose **Full Threat Details** in **Webhook Request Body**
  * Insert the following header into the **Headers**

    ```
    {"Content-Type": "application/json"}
    ```
  * Select **Always Send body**
  * Click **Next**
* Select your organization and site in the **Access Level**
* Click **Install**.