SentinelOne is an AI-powered security platform that can help you detect, prevent, and respond to advanced cyber threats.
Torq enables quick and easy integration with SentinelOne, so you can automate anything and everything within moments. Torq's public SentinelOne steps include:
Get notes for threat
Get exclusions
Update Firewall Control Rule
Create Custom Detection Rules
+51 more...
If you don't see a step you need, you can create your own in various ways, such as using the Send an HTTP Request step or Torq’s Step Builder, and share it across your organization.
Use SentinelOne to Trigger Workflows in Torq
Step One: Create a SentinelOne Trigger Integration in Torq
Navigate to Integration: Go to Build > Integrations > Triggers > SentinelOne and click Add.
Fill in the Details:
Give the integration a unique and meaningful name.
Under Authentication Headers click Add.
Give the secret a name.
Click Generate Random Secret.
Finalize: Click Save.
Step Two: Create a SentinelOne Singularity Marketplace Webhook
Go to SentinelOne: Log in to your Sentinel Management Console.
Go to Singularity Marketplace: In the top toolbar, select Singularity Marketplace.
Install a Webhook: Select the Singularity Webhook to open the webhook page in the catalog.
Click Install to add a new configuration.
Add a New Configuration:
Response Actions: Toggle to
Make Response Actions available as "Manual Response Actions" from Threats.Fill in the details for each threat response action:
Name: Give the threat response action a unique and meaningful name.
Description: Give a useful description.
Automated Trigger Option Dropdown: Select which threats you want to be sent to the webhook.
URL: Paste the endpoint URL from the SentinelOne integration you created in Torq from step one.
Action Dropdown: Select POST.
Webhook Request Body Dropdown: Select Full Threat Details.
Finalize: Click Install.
Now that you've successfully created a SentinelOne trigger, you can build your first SentinelOne-initiated workflow!
In Torq, go to Build > Workflows > Create a Workflow > New Blank Workflow, and select the trigger type: Integrations > SentinelOne. Find your new trigger, and automate away!
Use SentinelOne Steps in Torq
Step One: Create a SentinelOne API Key
Sign in to SentinelOne: Login to your SentinelOne portal with admin rights.
Create a Token:
Select the dropdown menu arrow next to your user name and select My User.
Go to Actions > API Token Operations > Generate API Token.
Save Token: Copy the API token and save it to use later in Torq.
Finalize: Click Close.
Step Two: Create a SentinelOne Steps Integration in Torq
Navigate to Integration: Go to Build > Integrations > Steps > SentinelOne and click Add.
Fill in the Details:
Give the integration a unique and meaningful name.
In the API Key field, paste the SentinelOne API key that you created previously in step one.
In the SentinelOne Management URL field, paste the section of the URL from your company's SentinelOne app (ex.
usea1-partners.sentinelone.net).
Finalize: Click Add.
Templates
Now that you've added your integrations, check out these specially crafted templates by Torq's security experts. Visit Torq's template library for more.