🚀 Deploying SentinelOne with Guardz Ultimate Plan
📌 Introduction
Integrating SentinelOne within the Guardz Ultimate Plan provides a unified security experience, simplifying the provisioning, deployment, and management of Endpoint Detection and Response (EDR) directly from the Guardz platform.
✅ What this integration enables:
🎯 Unified Security Management: Monitor S1-protected endpoints alongside Guardz email, cloud, and identity protections.
🔍 Streamlined Threat Response: SentinelOne-detected threats are automatically surfaced in Guardz Detection & Response.
🛡️ Continuous Device Posture Monitoring: Identify and fix security misconfigurations to maintain strong endpoint security.
💡 Important Notes:
Managed SentinelOne (S1) cannot be enabled simultaneously with BYO-S1.
A separate SentinelOne deployment is required per customer.
Site Tokens are unique per customer and should NOT be shared across organizations.
📌 Step 1: Enabling SentinelOne in Guardz
🔹 Activate SentinelOne Security Control
1️⃣ Log into Guardz.
2️⃣ Navigate to Security Controls (left sidebar) > Endpoint Security.
3️⃣ If required, click "Get Started" to enable the SentinelOne Security Control.
📌 Step 2: Provisioning the Managed SentinelOne Account
🔹 Select & Enable SentinelOne Managed Deployment
1️⃣ Under SentinelOne, click "Select" for the Managed SentinelOne option.
2️⃣ Click "Continue" to provision the SentinelOne account.
3️⃣ Once the SentinelOne account is provisioned, click "Deploy".
🚨 Note:
A customer cannot use both Managed-S1 and BYO-S1 at the same time.
It is possible to mix and match SentinelOne deployment types across different customers.
📌 Step 3: Deploying SentinelOne to Devices
🔹 Choosing a Deployment Method
Guardz provides two deployment options for SentinelOne agents:
1️⃣ Installer-based deployment
2️⃣ Script-based deployment (RMM, GPO, Intune, etc.)
🔹 To deploy SentinelOne:
Download the Installer or Deployment Script from Guardz.
View the Site Token (assigned per customer).
📌 Important: Do not reuse Site Tokens across different organizations.
Deploy SentinelOne to the customer’s devices using the preferred method.
📌 Step 4: Configuring SentinelOne Policy Settings in Guardz
🔹 Adjust SentinelOne Security Policies
1️⃣ Navigate to Security Controls > Endpoint Security > SentinelOne Managed.
2️⃣ Click the edit icon to open SentinelOne Policy Settings.
3️⃣ Modify detection sensitivity, mitigation responses, and security rules as required.
4️⃣ If necessary, override the global policy settings per customer.
📌 What These Settings Control:
✔ How the SentinelOne agent behaves on each device
✔ How threats are mitigated (e.g., auto-quarantine, isolation)
✔ Detection thresholds for security events
🚀 Changes made in Guardz directly impact SentinelOne agent behavior on endpoints.
📌 Troubleshooting Common Issues
🔹 Issue: "Managed SentinelOne is not provisioning."
✅ Fix:
Ensure your Guardz account is enabled for the Ultimate Plan.
Retry provisioning after a few minutes.
🔹 Issue: "SentinelOne installer fails to deploy."
✅ Fix:
Verify the correct Site Token is being used.
Ensure the endpoint has internet access during installation.
🔹 Issue: "Devices not appearing in Guardz."
✅ Fix:
Confirm that the SentinelOne agent is successfully installed on the device.
Check if the correct SentinelOne site is linked to the Guardz customer.
🔹 Issue: "Threats detected in SentinelOne are not showing in Guardz Detection & Response."
✅ Fix:
Verify that the SentinelOne Security Control is active in Guardz.
Check if the SentinelOne API connection is functioning properly.
📌 Best Practices for Deployment & Management
✔ Deploy SentinelOne using GPO, SCCM, or RMM for scalability.
✔ Monitor SentinelOne alerts from within Guardz Detection & Response.
✔ Review & customize SentinelOne policy settings per customer.
✔ Ensure Site Tokens are used correctly for each customer’s deployment.