About the SentinelOne Singularity™ Endpoint Integration
SentinelOne Singularity™ Endpoint is SentinelOne’s AI-powered endpoint protection and response platform, delivering autonomous threat prevention, detection, and response across endpoints without relying on human latency in the threat response cycle. Part of Synqly’s EDR Unified API, the SentinelOne Singularity Endpoint integration enables security platforms to access normalized endpoint detection data, threat alerts, and device telemetry through a standardized connector. Integrate with SentinelOne Singularity Endpoint to route AI-driven endpoint threat data into your SIEM, SOAR, or security operations platform, and enable automated response actions without managing SentinelOne’s API directly.
Integration Use Cases
Create IOA
Creates an IOA rule for the token-linked EDR source.
Create IOCs
Creates a list of iocs that match the stix input for the EDR source.
Create Threat Note
Creates a note for a threat.
Delete IOAs
Deletes the IOA rules identified by the ids in the query params. Some providers scope rule ids to a rule group; for those providers `group_id` is required.
Delete IOCs
Deletes a list of iocs that match the input of ids in the query param
Execute Command
Runs a provider-backed command on the endpoint identified by `{uid}` and returns normalized stdout and stderr without exposing provider session details.
Get Endpoint
Gets a single endpoint assets matching the UID from the token-linked EDR source.
Get Threat Notes
Returns a list of notes for a threat.
Quarantine Endpoints
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
Query Alerts
Returns a list of alerts that match the query from the token-linked EDR source.
Query Applications
Returns a list of applications matching the query from the token-linked EDR source.
Query EDR Events
Returns a list of EDR events that match the query from the token-linked EDR source.
Query Endpoints
Returns a list of endpoint assets matching the query from the token-linked EDR source.
Query Exclusions
Returns the exclusions configured in the token-linked EDR source as OCSF Compliance Findings, one per exclusion rule, with the rule's pattern, type, platform, owner and scope. By default only admin-created exclusions are returned; filter `resource.owner.type[in]Admin,System` to include rules the vendor manages.
Query IOAs
Returns a list of IOA rules that match the query from the token-linked EDR source.
Query IOCs
Returns a list of iocs that match the query from the token-linked EDR source.
Query Policies
Returns the protection policy at one level of the token-linked EDR source's policy tree (global, account, site or group; `resource.type` selects the level and defaults to global) as OCSF Compliance Findings, one per scope at that level, with each recommended setting as an assessment and the vendor policy setting that decided it. Findings describe the policy at the requested level; overrides below it are not reflected.
Query Threat Events
Returns a list of threats that match the query from the token-linked EDR source.
Retrieve File
Retrieves a file from the endpoint identified by `{uid}` and returns the provider artifact as a binary file response.
