> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> Import endpoint, application, threat, activity, and Data Lake telemetry from SentinelOne.

Forge connects SentinelOne management and Data Lake APIs to bring endpoint
identity, installed applications, security activity, and process and network
evidence into your AI estate.

SentinelOne-backed devices receive agentless Forge coverage through the agent
already deployed in your environment. Forge uses RemoteOps for endpoint setup,
inventory, validation, repair, credential rotation, and removal.

## Sources

| Lane                | Data                                                                 |
| ------------------- | -------------------------------------------------------------------- |
| Tenant scope        | Tenant, site, group, and system status                               |
| Endpoints           | Agents, devices, operating system, network identity, and users       |
| Applications        | Installed application inventory and version context                  |
| Threats             | Threats, cloud detection alerts, and detection metadata              |
| Activity            | SentinelOne activity records and supported timelines                 |
| Data Lake           | Process, network, DNS, and event telemetry                           |
| Endpoint operations | Agentless endpoint setup, inventory, and lifecycle through RemoteOps |

Management data and Data Lake telemetry use separate credentials and are
reported as separate capability lanes.

## Connection

| Field                   | Description                                                  |
| ----------------------- | ------------------------------------------------------------ |
| Base URL                | SentinelOne management console URL                           |
| Service-user token      | Management API credential; stored as a Forge-managed secret  |
| Data Lake key           | Optional SDL/log API credential for process and network data |
| Source instance         | Stable tenant identifier used in source provenance           |
| Optional diagnostics    | Enables non-core API probes in addition to essential lanes   |
| Page size and max pages | Bounds provider pagination for a collection run              |

## Setup

1. Open **Settings → Integrations → SentinelOne** and save the management
   console URL and service-user token.
2. Add the SentinelOne Data Lake key only when process, network, DNS, and event
   telemetry are required.
3. Test tenant scope, endpoint inventory, applications, threats, activity,
   telemetry, and response permissions independently.
4. Run a sync to import endpoints, bind endpoint-user evidence, and collect
   each enabled telemetry lane.
5. Enable RemoteOps for devices that will use SentinelOne as their Forge
   endpoint-management channel.

## Sync phases

| Phase                 | Result                                                     |
| --------------------- | ---------------------------------------------------------- |
| Management validation | Confirms tenant access and capability permissions          |
| Endpoint inventory    | Imports endpoints, applications, sites, and groups         |
| User observations     | Resolves provider user evidence without inventing identity |
| Endpoint attachment   | Links SentinelOne endpoints to Forge devices               |
| Telemetry             | Imports enabled management and Data Lake evidence          |
| Optional diagnostics  | Runs non-core provider probes when requested               |
| Health finalization   | Persists lane status, counts, errors, and checkpoints      |

A sync ends as `completed`, `partial`, `failed`, `timed_out`, `canceled`, or
`abandoned`. Partial results remain visible with their lane-specific reason.

Forge reconciles SentinelOne endpoints with directory and endpoint sources so
the same computer appears as one device with complete source history. Each sync
keeps successful data available while clearly identifying anything that needs
attention.

## Health

| State            | Meaning                                           |
| ---------------- | ------------------------------------------------- |
| `connected`      | Required request succeeded                        |
| `healthy_empty`  | Request succeeded and returned no records         |
| `partial`        | Some enabled lanes succeeded and others did not   |
| `denied`         | Credential lacks the required provider permission |
| `expired`        | Provider credential is no longer valid            |
| `rate_limited`   | Provider throttled the collection                 |
| `network_failed` | Forge could not reach the configured endpoint     |

For every lane, Forge records operation key, category, status, observed count,
page count, permission state, failure class, and recommended next action.