SentinelOne: protected endpoints, open threats, and licence use

5 min read · Updated Sep 5, 2026

SentinelOne is where your endpoint protection lives. This connector reads four things out of it: which machines actually have a working agent, what threats are open right now, whether those agents are reporting and up to date, and how many licences each partner is using — then hangs each one off the matching company in Current so it feeds your business reviews and the company alert band. Current reads SentinelOne and can never change anything in it.

Note

What this connector is for

It is a value-signal feed, not a console. Current mirrors site rosters, agent protection state, and the open threat list. It cannot isolate a machine, kill or quarantine a process, roll back a disk, uninstall an agent, run a script, or change a policy — those endpoints are not in the connector's code at all. When you need the file path or the hash behind a detection, the company card links you straight into SentinelOne, which is where that detail belongs.

What Current syncs

Data set	What Current stores	Where it lands
Sites	One row per SentinelOne site — the partner's name, its plan tier (Complete, Control, or Core), whether it is a paid or trial site, and its active and total licences.	The customer mapping panel, and the licence line on the company card.
Agents	Each endpoint's name, operating system, agent version, and whether it is active, decommissioned, reporting, and up to date. Plus the machine's own threat count.	Protected endpoints, agents offline, and agents out of date on the company card.
Open threats	Threats that are unresolved or being worked, from the last 90 days: the detection name, its classification, the confidence SentinelOne assigned, what an analyst decided, and whether it has been mitigated.	Open threats on the company card, and the security section of a business review.

Note

A site is a partner

SentinelOne organises your estate as accounts, then sites, then groups. Current maps on the site, because that is the level that means one partner — an account is usually your whole book, and a group is a slice inside one partner, like servers or laptops. Groups still show on the endpoint rows so you can tell a server from a laptop; they just never become a separate company.

Note

What Current deliberately does not store

Current mirrors the verdict and the count, never the forensic detail. File paths, file hashes, and publisher names stay in SentinelOne. So do sign-in names, IP and MAC addresses, and the list of software installed on a machine. Those identify a partner's people and files, they add nothing to a business review, and keeping them out is a deliberate choice rather than something we have not got to yet.

Before you start

＋Tenant Admin in Current — connecting an integration is an admin-only action.
＋An admin in SentinelOne who can create a Service User, which usually means signing in at the All Customers (Global) view.
＋The web address you sign in to SentinelOne at — something like https://usea1-999-yourcompany.sentinelone.net.

Create the token in SentinelOne

1
1 · Sign in to SentinelOne at the All Customers (Global) view
Creating the token from here is what lets one credential cover every partner. If you create it from inside a single site, it will only ever see that site.
2
2 · Go to Settings → Users → Service Users
A Service User exists only to hold an API token — it cannot sign in to the console, which is exactly what you want for an unattended feed.
3
3 · Press Actions → Create New Service User
Give it a name you will recognise later, such as "Current reporting feed".
4
4 · Choose the scope: Account
SentinelOne offers Global, Account, and Site. Account covers every site under that account, which is what this connector needs, without granting the console-wide reach of Global. Site scope is the one to avoid: the connector would see one partner, report no error, and look like your whole book had shrunk.
5
5 · Choose the role: Viewer
Viewer is read-only, and read is all this connector ever needs.
6
6 · Set the expiration, and write the date down
SentinelOne asks you to pick how long the token lasts and defaults to one year. The expiry cannot be changed afterwards and a token cannot be renewed in place — when it lapses you create a new one. Put the date in a calendar now; a lapsed token looks exactly like a wrong one.
7
7 · Copy the token before you leave the page
SentinelOne shows it once and never again. If you lose it, delete the Service User and create another.

Connect it in Current

1
Open Settings → Integrations → SentinelOne
Only Tenant Admins see this page.
2
Paste your console address
Use the address you sign in at, including https://. If you paste a longer link copied from your browser's address bar, Current trims it back to the console address for you. Every SentinelOne customer has their own address, so there is no list to pick from.
3
Paste the API token
The one you copied from the Service User. It is stored encrypted and is never shown again, not even to you.
4
Press Test connection
Current makes a single read to prove the token works and to count the sites it can see. If that comes back green, you are connected; the first full sync starts on the next scheduled run, and Current syncs every six hours after that.

Match sites to companies

Current links each SentinelOne site to a company by name, and links only when exactly one company matches. Anything ambiguous is left for you, which is why some sites start out unmapped rather than being attached to a company that might be wrong.

1
Open Integrations → SentinelOne → Manage → Customer mapping
The Unmapped tab lists every site Current could not place with confidence.
2
Press Map beside a site and pick the company
Its endpoints and threats attach right away rather than waiting for the next sync.
3
Leave the rest alone
A mapping you set by hand is never overwritten by a later automatic match.

Note

Sites that are gone

A site SentinelOne reports as deleted or expired still appears in the mapping panel, so a partner who vanished from the console is explained rather than silently missing. It is left out of every current count and is never matched automatically.

What you will see

＋Protected endpoints — machines with an active, non-decommissioned agent, split by server and workstation where SentinelOne says which.
＋Open threats — what is unresolved or being worked right now, newest first, with the classification named.
＋Agents offline — machines whose agent is not reporting, with the oldest last-seen date. This is the number that tells you whether a protection count means anything.
＋Agents out of date — machines behind on the agent version, taken from SentinelOne's own flag rather than guessed by comparing version numbers.
＋Licence use — active against total licences for the site, with the plan tier named. A site on unlimited licences reads "unlimited" rather than a percentage.

Note

Blank is not zero

Where SentinelOne does not report something, Current leaves it blank instead of showing a zero. If the threat list could not be read on a run, open threats show as unknown rather than as a clean estate — a number that looks reassuring and is not measured is worse than no number.

The read-only guarantee

The connector holds a list of the exact addresses it is allowed to call, and every request is checked against that list before it is sent. The list has five entries, all of them reads: sites, accounts, agents, an agent count, and threats. Everything else SentinelOne offers — isolating a machine, killing or quarantining a process, rolling back a disk, uninstalling an agent, running a script, editing a policy, retrieving an agent passphrase or an uninstall password, or creating and revoking tokens — is absent from that list, so the connector cannot reach it even if something in the code went wrong. Choosing the Viewer role in SentinelOne is a second lock on the same door.

Troubleshooting

What you see	What it means	What to do
SentinelOne rejected this API token	The token is wrong, expired, or was revoked — and a token cannot be renewed in place.	Create a new Service User token in SentinelOne (Settings → Users → Service Users → Actions → Create New Service User), copy it while it is on screen, and paste it in. If you are certain the token is current, check you pasted the token itself and not a Service User name.
Current couldn't find a SentinelOne API at that address	The console address is wrong — this is not a token problem.	Check the address is the host you sign in at, with nothing after the domain. Copying the address bar from inside the console is fine; Current trims the rest.
SentinelOne accepted this token but wouldn't show the site list	The Service User's role or scope is too narrow.	Create it again from the All Customers (Global) view with the Viewer role and Account scope.
It can't see any sites, so there'd be nothing to sync	The token works but was created at Site scope, or against an account with no sites.	Create the Service User at Account scope so it covers every partner.
SentinelOne is rate-limiting this token	Too many requests reached SentinelOne at once. It does not mean the token is wrong.	Wait a minute and press Test connection again. Scheduled syncs back off on their own and pick up where they left off.
Only one site appears, and you have more partners	Almost always a token created at Site scope rather than Account scope.	Create the Service User again from the All Customers (Global) view, choose Account scope, and reconnect with the new token.

Tip

Diary the expiry

The token defaults to a one-year life and cannot be renewed, so about a year after you set this up it stops working and nothing announces it in advance. The card shows the console it is connected to and when it last synced — if the last sync date stops moving and the card reports a rejected token, that is the expiry rather than a fault. Create a new Service User token and paste it in.

Tip

Disconnecting

Disconnect on the card stops all SentinelOne syncing. Your already-synced site, endpoint, and threat data is kept — reconnect any time to resume.

Was this helpful?

← Previous

Huntress: protected endpoints, EDR coverage, and SOC incidents

ThreatLocker: protected endpoints, enforcement mode, and what was blocked