> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> Connect SentinelOne to Myrmex — generate an API token and add the integration to triage its threats in real time.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect **SentinelOne** so Myrmex can read its threats and alerts, endpoint inventory, and help you triage and respond. Myrmex queries the SentinelOne management console API in real time through a [Collector](/documentation/agent-endpoint-security/collector-mode).

<Note>
  Myrmex connects on demand and reads (and acts) in real time — nothing from SentinelOne is stored on the Myrmex side.
</Note>

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Threats & alerts" icon="bell">
    Read SentinelOne threats live and triage them in [Alerts](/documentation/detection-response/alerts).
  </Card>

  <Card title="Endpoint inventory" icon="laptop">
    Read managed agents and their status on demand.
  </Card>

  <Card title="Investigate with AI" icon="robot">
    Let [Hydra](/documentation/multi-agent-system/integration-specialist-agent) query SentinelOne to explain detections.
  </Card>

  <Card title="Guided response" icon="shield-halved">
    Propose isolate and quarantine actions, always with your approval.
  </Card>
</CardGroup>

## Before You Start

* A SentinelOne account that can generate API tokens — a service user is recommended.
* Your SentinelOne **management console host**.
* A [Collector](/documentation/agent-endpoint-security/collector-mode) that can reach the console over outbound HTTPS.

## Step 1 — Create the Credential in SentinelOne

<Steps>
  <Step title="Create a service user (recommended)">
    In the console, go to **Settings → Users → Service Users** and create a new service user scoped to the right account, site, or group, with a role that has the access Myrmex needs (Viewer for read; higher for response actions).
  </Step>

  <Step title="Or use your profile">
    Alternatively, open **My User → Options → Generate API Token**.
  </Step>

  <Step title="Copy the token">
    Copy the API token now — it's shown only once. Note your console host (for example `usea1-016.sentinelone.net`).
  </Step>
</Steps>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → SentinelOne**, then fill in:

| Field            | Description                                                                                                      |
| ---------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Name**         | A unique name for this SentinelOne instance.                                                                     |
| **Description**  | Optional note to identify the tenant.                                                                            |
| **Collector**    | The [Collector](/documentation/agent-endpoint-security/collector-mode) that connects to the SentinelOne console. |
| **Console Host** | Your management console host, without scheme or path (e.g. `usea1-016.sentinelone.net`).                         |
| **Port**         | API port (default `443`).                                                                                        |
| **API Token**    | The token from Step 1 (sent as `Authorization: ApiToken <token>`).                                               |

## Connect

Click **Connect** to validate the token. SentinelOne then appears under **Environment → Integrations**, and you can triage its threats — queried live — in [Alerts](/documentation/detection-response/alerts).