SentinelOne

Overview
How to connect
Automated checks
Useful links

DSALTA connects to SentinelOne using read-only API access to collect compliance evidence automatically. DSALTA syncs the users in your SentinelOne management console (for access reviews) and application CVE risks. Data feeds into your Data Library modules.

Read-only access. DSALTA never modifies, creates, or deletes resources in your SentinelOne account.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads the SentinelOne user roster — names, emails, creation dates and two-factor status, which appears on your Access page. DSALTA requests no role or account-state field from SentinelOne’s console user API, so every user is listed as an active User. It also reads application CVE risk findings, which appear on your Vulnerabilities page.It calls these SentinelOne endpoints:

/web/api/v2.1/system/info
/web/api/v2.1/users
/web/api/v2.1/application-management/risks

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your SentinelOne environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the SentinelOne card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from SentinelOne. This can happen if the API token was revoked or rotated in the SentinelOne console.

Data is not syncing

Confirm the API token is still valid and the Console URL is correct, then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.

Before you begin

Access to your SentinelOne management console with permission to create Service Users (Settings → Users → Service Users).

Open the integration

In the DSALTA sidebar, go to Integrations, find SentinelOne, and click Connect.

Enter your credentials

SentinelOne connects with a credential you create in SentinelOne itself — DSALTA does not open an authorization window. Paste the values into the connect panel and confirm.Create the credential in SentinelOne first: Settings → Users → Service Users → Actions → Create New Service User. Give it a name (e.g. DSALTA), then choose a Scope of Access and finish the dialog — SentinelOne shows the API token once, at the very end, and it cannot be viewed again afterwards, so copy it straight away. The connect panel asks for exactly two values: Hostname and API Token.Hostname is your console host only — for example your-tenant.sentinelone.net. Do not include https:// (the field already shows it) and do not include a path. It is the host in the URL you use to sign in to the SentinelOne console.

The Expiration Date you choose on the service user is the day this integration stops syncing. SentinelOne lets you leave it unset for a non-expiring token; if your policy requires an expiry, diary the renewal, because there is no Reconnect button in DSALTA — the only repair is Disconnect and connect again, which permanently deletes the access records, vulnerabilities and test results already collected from SentinelOne.

SentinelOne management console Settings page on the Users tab with Service Users selected in the left list and the Actions menu open showing Create New Service User and a grayed-out Copy User option

SentinelOne Create New Service User dialog with Name and Description filled in as Test Nango, an Expiration Date dropdown set to 1 Week showing Apr 09, 2026 11:49:00, a warning about minimizing API token expiration duration, and Cancel and Next buttons

SentinelOne Select Scope of Access dialog with Account selected as the Access Level, a Site option beside it, a search field, and a counter reading 0 / 1 Accounts selected

DSALTA Link SentinelOne Account panel with a required Hostname field prefixed https:// and placeholder your-tenant.sentinelone.net, a required API Token field, and a Connect button

Once connected, SentinelOne appears on the Connected tab and the checks below begin reporting after the first sync.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
User access to Critical System should be valid	Info	Checks that everyone with SentinelOne access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active SentinelOne access.

Topic	Link
General	SentinelOne website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting