Torq

SentinelOne delivers autonomous security for endpoints, data centers, and cloud environments to help organizations secure their assets. 

Use the SentinelOne integration to interact with core aspects directly from Torq workflows. SentinelOne steps within Torq include: 

- Add Note to Threats
- Broadcast Message
- Cancel Deep Visibility Query
- Connect to Network
- Create Blacklist Item
- Create Custom Detection Rules
- Create Deep Visibility Power Query
- Create Exclusion
- Delete Blacklist Item
- Get Agents
- +45 more...

Look <a href="#h_bb2badb472">here</a> if you want to trigger a workflow based on events sent from SentinelOne. ​ Look <a href="#h_e4cf736c38">here</a> if you want to use SentinelOne steps in a workflow.

Trigger a Torq Workflow from SentinelOne Events

Create a SentinelOne Trigger Integration in Torq

Go to Build &gt; Integrations &gt; Triggers &gt; SentinelOne and click Add.

Give the trigger a meaningful and unique name. 

1. You will not be able to change this later. 

Under Authentication Headers click Add.

1. Click Generate Random Secret and save the secret created.

1. Go to Build &gt; Integrations &gt; Triggers &gt; SentinelOne and click Add.
2. Give the trigger a meaningful and unique name. 
 1. You will not be able to change this later. 
3. Under Authentication Headers click Add. 
 1. Click Generate Random Secret and save the secret created. 
4. Click Add.

Create a SentinelOne Singularity Marketplace App

In SentinelOne, log in to your Management Console and click Singularity Marketplace.

Search for Singularity Webhook and click Install.

1. Toggle the Response Actions to <code>Make Response Actions available as "Manual Response Actions" from Threats</code>. 
2. Give the threat response action a unique and meaningful name, such as Torq Webhook.
3. Give the threat response action a meaningful description such as <code>Send response to Torq</code>. 
4. Under the Automated Trigger Option, select which threats you want to be sent to the webhook. 
5. In the URL parameter, paste the webhook generated <a href="#h_ce6536afa1">earlier in Torq</a>. 
6. Under Action, select POST. 
7. In the Webhook Request Body parameter, select Full Threat Details.

Click Next and select the access level for the app: Global, Account, or Site.

1. In SentinelOne, log in to your Management Console and click Singularity Marketplace. 

2. Search for Singularity Webhook and click Install. 
3. Fill out the relevant details: 
 
 1. Toggle the Response Actions to <code>Make Response Actions available as "Manual Response Actions" from Threats</code>. 
 2. Give the threat response action a unique and meaningful name, such as Torq Webhook.
 3. Give the threat response action a meaningful description such as <code>Send response to Torq</code>. 
 4. Under the Automated Trigger Option, select which threats you want to be sent to the webhook. 
 5. In the URL parameter, paste the webhook generated <a href="#h_ce6536afa1">earlier in Torq</a>. 
 6. Under Action, select POST. 
 7. In the Webhook Request Body parameter, select Full Threat Details. 
4. Click Next and select the access level for the app: Global, Account, or Site. 
5. Click Install.

In the upper-right corner, click the arrow next to your user name and select My User.

Click Generate next to the API token.

Download and copy the API key for later use. 

1. Log in to your SentinelOne portal.
2. In the upper-right corner, click the arrow next to your user name and select My User.

3. Click Generate next to the API token. 

4. Download and copy the API key for later use.

Create a SentinelOne Steps Integration in Torq

Go to Build &gt; Integrations &gt; Steps &gt; SentinelOne and click Add.

Give the integration a meaningful name. This cannot be changed later.

Enter the API key you <a href="#h_efbcfc1edd">created earlier</a>.

Enter your management URL without the <code>https://</code> prefix. For example, <code>&lt;company-name&gt;.sentineleone.net</code>

1. Go to Build &gt; Integrations &gt; Steps &gt; SentinelOne and click Add.
2. Give the integration a meaningful name. This cannot be changed later.
3. Enter the API key you <a href="#h_efbcfc1edd">created earlier</a>.
4. Enter your management URL without the <code>https://</code> prefix. For example, <code>&lt;company-name&gt;.sentineleone.net</code> 
5. Click Add.

Secure assets with SentinelOne's unified AI-driven platform and Torq's automated workflows.

Trigger a Torq Workflow from SentinelOne Events

Create a SentinelOne Trigger Integration in Torq

Create a SentinelOne Singularity Marketplace App

Use SentinelOne Steps in a Torq Workflow

Create a SentinelOne API Key

Create a SentinelOne Steps Integration in Torq