Skip to main content

​
After this article

You’ll be able to connect SentinelOne to Lumos and authenticate the integration so Lumos can read from your SentinelOne tenant.

​
Capabilities

​
Required plan and roles

  • SentinelOne plan: no minimum SentinelOne plan is required to connect this integration.
  • SentinelOne role: the API token must be generated by a user with the Admin role.
  • Permission scoping: the connection is read-only. Lumos authenticates against SentinelOne and does not write back.

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only way this connector works. SentinelOne connects with a single read-only API token. Lumos authenticates against your SentinelOne tenant and never writes back, so there’s no provisioning mode to opt into. What read-only requires. An API token generated by a SentinelOne user with the Admin role, plus the tenant’s Base URL. Follow the steps below. Watch out for. A token generated by a non-admin user won’t authenticate, and a Base URL that doesn’t match your tenant will reject the token even if the token itself is valid.

​
Instructions

Phase 1: Connect in Lumos
  1. Find the SentinelOne card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Provide your API Token and Base URL.
  3. Click Connect.
Generate the API token with a SentinelOne user that has the Admin role. A token from a non-admin user cannot authenticate the integration.

​
Troubleshooting

Connection fails when saving credentials. Confirm the API token was generated by a user with the Admin role. Tokens from non-admin users cannot authenticate. Wrong Base URL. Enter the Base URL that matches your SentinelOne tenant. A mismatched URL rejects the token.