SentinelOne

SentinelOne is an endpoint security platform that uses AI to detect, prevent, and respond to malware, ransomware, and other advanced threats. RunReveal can pull two different kinds of SentinelOne data—and they are set up differently.

Sentinel One (API polling)

This source polls the SentinelOne management API for activity and threat data. It does not bring in Deep Visibility endpoint telemetry—that is the object-storage source below.

Ingest method

RunReveal polls the /activities API approximately every 60 seconds and backfills up to 365 days of history on first connect.

Setup

Step 1: Log in to SentinelOne Management Console

1. Open your web browser and navigate to your SentinelOne Management Console URL.
2. Enter your credentials and click Sign In.

Step 2: Access the API Token Generation Page

1. Click your user profile icon in the top-right corner.
2. Select My User.
3. In the left sidebar, click API Tokens.

Step 3: Generate a New API Token

1. On the API Tokens page, click Generate.
2. Enter a descriptive name (for example, RunReveal Integration).
3. Select at least Read scope for the key.
4. Set an expiration date.
5. Click Generate and copy the token.

Step 4: Create the source in RunReveal

1. Go to Sources and choose the Sentinel One tile (the API polling one—not SentinelOne Endpoint Logs).
2. Enter your SentinelOne management console URL and API token.

Logs should appear within about a minute. Backfill may take longer before history is fully current.

Verify It's Working

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'sentinelone' LIMIT 1

SentinelOne Endpoint Logs (object storage)

Ingests Deep Visibility-style endpoint events (newline-delimited JSON) from a bucket you control. SentinelOne exports these logs to S3 (or another supported object store); RunReveal does not pull them from the management API.

Typical events include process creation, network connections, DNS lookups, and related EDR fields (event.type, src.process.*, i.scheme, etc.).

Ingest methods

Configure ingestion using one of the following guides:

• AWS S3 Bucket
• AWS S3 Bucket with Custom SQS
• Google Cloud Storage
• MinIO and other S3-compatible storage follow the same SNS notification pattern as AWS S3

arn:aws:sns:<REGION>:253602268883:runreveal_sentinelone_endpoint

Setup

1. SentinelOne: Configure log export (for example, Singularity Data Lake or your existing pipeline) so Deep Visibility / endpoint logs land in your S3 bucket as newline-delimited JSON objects.
2. AWS: Grant RunReveal read access to that bucket and add an S3 event notification for All object create events targeting the SNS topic ARN above. See AWS S3 Bucket for bucket policy, IAM role, and notification steps.
3. RunReveal: Go to Sources, select SentinelOne Endpoint Logs, choose AWS S3 Bucket (or Custom SQS if you fan out notifications to your own queue), and provide bucket access credentials.

Verify It's Working

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'sentinelone-endpoint' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• SentinelOne API Documentation - Management API reference for activity and threat endpoints