Introduction
This guide walks you through the process of integrating your existing SentinelOne (S1) deployment with Guardz using a Site Service User API Token.
What this integration enables:
Sync SentinelOne-managed devices with Guardz.
Automatically open S1-detected endpoint threats as issues in Guardz Detection & Response.
Manage & remediate threats directly from the Guardz platform.
Inherit & modify SentinelOne security policies within Guardz.
Important Notes:
Each Guardz customer corresponds to a SentinelOne Site.
A separate API token is required for each site.
Admin permissions are required for setup.
Step 1: Configure SentinelOne API Access
Generate a Site Service User API Token in SentinelOne
Log in to the SentinelOne Management Console.
Navigate to Navigate to Settings → Users → Service Users, then click Actions → Create New Service User.
Enter Details:
Name: Use a descriptive name like
"Guardz Integration".Expiration: Set to 1 year or longer to minimize renewals.
Scope of Access: Select "Site", then choose the Account & Site to integrate.
Site Role: Change from Viewer (default) → Admin (Admin permissions required).
5. Click "Create Service User".
6. Copy the API Token displayed on the next screen and store it securely.
Repeat these steps for each SentinelOne site you want to integrate with Guardz.
Step 2: Connect SentinelOne to Guardz
Configure SentinelOne in Guardz
Log into Guardz.
Navigate to Security Controls > Endpoint Security.
If required, click "Deploy" to activate the SentinelOne Security Control.
Under SentinelOne Endpoint Protection, click "Connect".
Enter your SentinelOne details:
Subdomain:
<your-subdomain>.sentinelone.net
API Token: Paste the Service User API Token from SentinelOne.
6. Click "Save & Connect".
Once connected:
All SentinelOne-managed devices will appear in Guardz > Devices.
Threats detected by SentinelOne will automatically open as issues in Guardz Detection & Response.
You can manage SentinelOne security policies from within Guardz.
Step 3: Adjust SentinelOne Site Policy Settings in Guardz
After integration, SentinelOne policies will be inherited in Guardz. You can:
Modify detection sensitivity settings for endpoint protection.
Configure automated remediation rules for threats detected by SentinelOne.
Adjust response actions for high-risk detections (e.g., device isolation).
To modify SentinelOne policies in Guardz:
Navigate to Security Controls > Endpoint Security > SentinelOne Settings.
Adjust site-specific security policies as needed.
Click "Save" to apply the changes.
Troubleshooting Common Issues
Issue: "Failed to connect SentinelOne API."
Fix:
Verify the correct API Token was used (ensure it has Admin permissions).
Check if the subdomain is correct (it should be
<your-subdomain>.sentinelone.net).
Issue: "Devices not syncing in Guardz."
Fix:
Ensure SentinelOne agents are properly deployed and reporting to the correct Site.
Confirm that the SentinelOne API user has the correct site scope assigned.
Issue: "SentinelOne Threats not appearing in Guardz Detection & Response."
Fix:
Ensure the API integration is active in Security Controls > Endpoint Security.
Check SentinelOne threat logs to confirm new detections are registered.
Issue: "SentinelOne security policies not reflecting in Guardz."
Fix:
Try reloading SentinelOne Site Policy Settings in Security Controls > Endpoint Security.
Best Practices
✔ Regularly rotate API tokens to maintain security.
✔ Monitor API connection health in Security Controls > Endpoint Security.
✔ Ensure SentinelOne sites are correctly mapped to Guardz customers.
✔ Use Guardz Detection & Response for unified security monitoring across endpoints.