SentinelOne integration
This document describes integrating the Rezonate product with SentinelOne, which provides observability to on-premise hosts, users, and detection data.
Last updated
This document describes integrating the Rezonate product with SentinelOne, which provides observability to on-premise hosts, users, and detection data.
Last updated
Get your Webhook authentication Rezonate, this can be done via the Integrations Interface or Prelude CLI. Save generate-webhook output to be used in the following steps. To generate the webhook:
Click on the settings button on the top right menu.
Click on the Integration panel in Rezonate and then "New Integration".
Select S1 Integration and click Connect.
Select a name for the new integration (it can be any name) and click Save.
Take note of the webhook URL, we will use it in the next step.
Select Singularity XDR Webhook, and click Configure.
Click and expand the dropdown menu:
Select the box under Response Actions: Make "Hooks" available as "Manual Response Actions" from Threats
Select the Name for the configuration.
Select "Options for triggering" and Paste the webhook created in Step 1 to the URL field
Select POST in Action, and choose Full Threat Details in Webhook Request Body
Insert the following header into the Headers
Select Always Send body
Click Next
Select your organization and site in the Access Level
Click Install.
