SentinelOne EDR Discovery

SentinelOne EDR Discovery imports read-only endpoint and Singularity Data Lake evidence into AgentKeeper AI Discovery.

Required SentinelOne Permissions

Create or choose an API token with:

• Endpoints View
• Singularity Data Lake Search View
• Singularity Data Lake Data View
• Singularity Data Lake Data View EDR

Use the smallest site, account, or group scope that covers the endpoints you want AgentKeeper to review.

Required Values

In Settings -> Connectors -> Endpoint Discovery (EDR) choose SentinelOne and enter:

• console URL;
• API token;
• optional Data Lake URL;
• optional endpoint filter.

The console URL should be the base URL for your SentinelOne console, without a trailing slash.

API Paths Used

AgentKeeper uses:

• GET /web/api/v2.1/agents to enumerate endpoint seed data.
• GET /web/api/v2.1/installed-applications when the tenant exposes installed application inventory.
• POST /api/powerQuery against the Singularity Data Lake URL when configured.

The connector also defines the Deep Visibility fallback path:

• POST /web/api/v2.1/dv/init-query
• GET /web/api/v2.1/dv/query-status?queryId=...
• GET /web/api/v2.1/dv/events?queryId=...

V1 stores only normalized indicators from those paths. It does not store raw SDL or Deep Visibility payloads.

Endpoint Filter

Use the endpoint filter to limit sandbox validation to a known group or host set. Start without a filter if you are not sure which field your tenant expects, confirm results, then narrow the filter.

Imported Evidence

SentinelOne evidence can identify:

• installed applications when the tenant exposes that inventory;
• process, file, package, and application activity from Singularity Data Lake;
• endpoint host context such as hostname, platform, last user, and last seen;
• version and confidence when available.

Singularity Data Lake evidence is activity-based. If an AI agent is installed but has never run during the available event window, SentinelOne may not report it through SDL.

Troubleshooting