Onboard SentinelOne Singularity to Mandiant Threat Defense

The following prerequisites must be met before connecting your SentinelOne instance to Mandiant Threat Defense:

The SentinelOne subscription must have the following features:

• An active Singularity Complete subscription for SentinelOne. Cloud Funnel telemetry streaming is a necessary option, and now it is not available for Singularity Core or Singularity Control packages. Refer to Platform Packages for additional details.
• An active license for the Cloud Funnel Data Lake Streaming Module. This module is used to stream telemetry data to Mandiant Threat Defense for threat hunting and alert investigation.

Mandiant Threat Defense needs the following access:

• An API Token with Admin role for the Global or Account level
• Ensure that you are assigned the Team Admin role within the Managed Defense Portal to onboard or rotate credentials.

Your Sentinel One Account ID can be found by logging into your Sentinel One Singularity Portal. Once authenticated, click the "Sentinels" navigation button on the left, followed by the ACCOUNT INFO tab at the top-right. You receive the basic account information, which includes your ACCOUNT ID and a button that lets you copy content. Click copy and paste it somewhere safe. Refer to the following screenshot for a visual guide on how to copy the Account ID.

SentinelOne Account ID

The SentinelOne platform comes with multiple built-in roles. However, only the Admin role has all the permissions needed for the Mandiant Threat Defense service to be successful. This role comes with many permissions that are not needed by Mandiant Threat Defense. If using the Admin role is not acceptable, follow these steps to create a role to suffice for Mandiant Threat Defense service. Otherwise, skip to the next step.

1. In SentinelOne, navigate to the User Roles page (Settings > Users > Roles) and select New Role from the Actions menu.
   

   Create New Role option in the Actions menu

2. Fill in the Role Name and Description fields.
3. Select permissions as follows:
   • Endpoints (seven permissions)
     • View
     • View threats
     • Search on Deep Visibility
     • Reconnect to Network
     • File Fetch
     • Disconnect from Network
     • Fetch Logs
   • Click Save.

Mandiant Threat Defense SentinelOne integration requires one service account:

• API Admin Service Account

Create MD API Admin service account

The MD API Admin service account is used for collecting endpoint details, Endpoint Protection Platform (EPP) threats/Simulated Target Attack Response (STAR) alerts, and executing acquisition actions on a SentinelOne instance.

1. From the SentinelOne instance, navigate to the Service Users page (Settings > Users > Service Users) and select Create New Service User from the Actions menu.

   

   Create New Service User option in the Actions menu

2. Fill in the Name, Description, and Expiration Date fields.

   

   Create New Service User screen

3. Select the Global access level (or Account level if you are on a shared tenant) and Admin role. If more granular role permissions are required, see the preceding section on user account creation for granular level details.

   Select Scope of Access for MD API Admin

4. After clicking Create User, record the Service Token details (API Token and expiration date) and provide them to Mandiant Threat Defense.

   API Token for MD API Admin

Add containment tag to endpoints

Once you have generated your API and telemetry credentials in SentinelOne, follow these steps to securely onboard the integration directly within the MD Portal:

1. From the MD Portal navigation bar, click Integrations.
2. Click Add new integration.
3. For the Type, choose SentinelOne, and then click Next.
4. Fill out the required fields with the SentinelOne credentials that you created in the previous steps:
   • API Credentials (All Customers): Enter your SentinelOne Console URL, SentinelOne Account ID, API Token, and your credential Expiration date.
   • Event Telemetry: For Include Event Telemetry, select your Source Type.
     • If using Amazon S3: Enter your S3 URI, Access Key ID, and Secret Access Key.
     • If using Google Cloud Storage: Enter your Storage bucket URI.
       
       

       Upon selecting this source type, a message appears displaying a specific Mandiant service account.
       
       Before submitting this integration, you must navigate to your cloud storage environment and grant this exact service account the necessary permissions to fetch data from the source.
       
       

       If you do not grant these permissions prior to clicking Save, automatic feed creations will not work.This will require manual intervention and a Mandiant Service Transition Manager (STM) needs to contact you to resolve the failure.

     • If using Azure Blob Storage: Enter your Azure URI and SAS Token.
       Organizations that have connected their own Google SecOps instance to the service will only see the options for providing an API client to Mandiant for orchestrations. You should configure the SentinelOne data feeds within your SecOps instance.
5. Click Save to finalize the configuration. A banner appears confirming that the integration was onboarded successfully.
   
   

   After saving the configuration, the integration will be in a Provisioning state and will not display any errors with the integration. Please give the integration until the next business day and check back to see if it is in an Operational state. The Service Delivery Engineering team will be in contact with you if there is an issue with recommended remediation steps.

If you encounter issues with connecting your technology to the portal, see Troubleshoot technology onboarding for Mandiant Threat Detection.