SentinelOne Setup

SentinelOne is an endpoint detection and response (EDR) platform. Once connected, Junto can look up endpoints, investigate threats and alerts, manage endpoint isolation, trigger scans, and run Deep Visibility queries across your fleet.

Prerequisites

• A SentinelOne account with API access
• An API token generated from your SentinelOne management console
• Your SentinelOne instance URL (e.g., https://usea1.sentinelone.net)

Step 1: Generate an API Token

1. Log in to your SentinelOne management console.
2. Navigate to Settings > Users and select your user account.
3. Under API Token, click Generate to create a new token.
4. Copy the token. It will not be shown again.

Step 2: Configure in Junto

1. In Junto, go to Settings > Integrations > SentinelOne.
2. Click Add Configuration and fill in:
   • API URL -- Your SentinelOne instance URL.
   • API Token -- The token from Step 1. This is encrypted before storage.
3. Click Create. Junto validates the connection by listing your SentinelOne sites.

Step 3: Map Companies to Sites

SentinelOne organizes endpoints into Sites. Each MSP client is typically a separate site.

1. After connecting, Junto lists available sites from your SentinelOne account.
2. Use the company mapping interface to link each Junto company to its SentinelOne site.
3. Auto-map is available to match by name.
4. Save mappings.

What the AI Agent Can Do

Endpoint Management

Tool	Description	Risk Level
List Endpoints	Search for endpoints by hostname, OS type, infection status, or active status	Low
Get Endpoint Details	View detailed information about a specific endpoint	Low
Scan Endpoint	Initiate a full disk scan on one or more endpoints	Medium
Isolate Endpoint	Disconnect an endpoint from the network (network quarantine)	High
Reconnect Endpoint	Restore network access to a previously isolated endpoint	High

Threat Investigation & Response

Tool	Description	Risk Level
List Threats	List detected threats with filtering by resolved status, mitigation status, or analyst verdict	Low
Get Threat Details	View detailed information about a specific threat	Low
Mitigate Threat	Take action on a threat: kill, quarantine, remediate, or rollback	High
Update Threat Verdict	Set analyst verdict (true positive, false positive, suspicious, or undefined)	Medium
Add Threat Note	Add analyst notes to a threat for documentation	Medium

Alert Management

Tool	Description	Risk Level
List Alerts	List cloud detection alerts with optional filtering by analyst verdict	Low
Update Alert Verdict	Set analyst verdict on cloud detection alerts	Medium

Deep Visibility Queries

Tool	Description	Risk Level
Create Query	Search endpoint telemetry data across your fleet	Medium
Check Query Status	Check the status of a running Deep Visibility query	Low
Get Query Results	Retrieve events from a completed Deep Visibility query	Low

Infrastructure

Tool	Description	Risk Level
List Sites	List all SentinelOne sites in the account	Low

High-impact actions like endpoint isolation, reconnection, and threat mitigation require explicit technician approval before the agent proceeds.

Troubleshooting

• Connection fails -- Verify your API URL and token. Ensure the token has not expired or been revoked.
• No sites listed -- Confirm your API token has sufficient permissions to view sites.
• Endpoint not found -- Check that the company mapping is correct and the endpoint is enrolled in the expected site.
• Deep Visibility query returns no results -- Ensure target endpoints are online with the SentinelOne agent running. Queries search recent telemetry data.