> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> Connect your SentinelOne management console to Triggr with a service user's API token.

Triggr works with SentinelOne accounts, sites, groups, agents, installed applications and threats, and can scan, disconnect, reconnect, reboot and uninstall endpoints.

## Set up SentinelOne

Create a service user for Triggr. SentinelOne's guide is in your console's built-in help: add `/docs/en/creating-service-users.html` to your console URL.

**1. Start a service user**

In the scope selector, select the account or site Triggr should work with. Go to **Settings > Users > Service Users** (in newer consoles, Policy & Settings > User Management > Service Users) and click **Actions > Create New Service User**.

**2. Name it and set the expiry**

Set Name to `Triggr` and choose the longest Expiration Date your policy allows; you can't change either later. Click Next.

**3. Choose access and role**

Set Access Level to Account for every site, or Site for the sites you select. Choose Viewer to only read data, or Admin (or a custom role that allows them) to scan, disconnect, reconnect, reboot or uninstall agents and retrieve uninstall passphrases. Click Create User.

**4. Copy the API token**

Copy the token before you click Close. SentinelOne shows it only once.

## Connect it in Triggr

**1. Open the configuration**

Go to **Integrations > SentinelOne** and click **Configure** on the Base Configuration card.

![The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=bb81acb082055015f91beda7b4876f35)

**2. Enter the token and console**

Paste the token into API Token, without an `ApiToken` prefix. Enter your Management Console URL with `https://` and nothing after the host name, such as `https://usea1-partners.sentinelone.net`, and click Save Configuration.

![The SentinelOne configuration window with API Token and Management Console URL fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/sentinelone/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=3a91432b0d1d141f0c1cc0402b7d129f)

One connection covers every site the service user can see.

## Map your clients

The Client Mapping card lists those sites. Click **Apply 100% Matches**, then choose the site in Mapped to for any client left. Triggr saves each match as the client's `sentinelOneSiteId` variable (and its account as `sentinelOneAccountId`), for actions' `siteIds` and `accountIds` inputs.

![The Client Mapping card with All, Mapped and Unmapped filters, Acme Corp mapped to Acme Corp with a 75% suggested mapping, and Globex unmapped with a Select ConnectWise Manage clients dropdown.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/client-mapping.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=da797e78dc917005df8e55c6b6cb166b)

## Renew the API token

Every action fails once the token expires. Before then, select the `Triggr` service user and click **Actions > Copy User** to create a replacement with a new expiry (or Actions > Regenerate API Token, which stops the old token straight away). Then click **Edit** on the Base Configuration card and paste the new token.

![The Base Configuration card with Status Configured, Admin Consent Not Required, and Unlink and Edit buttons.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration-configured.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=73e58be09bb3c5d679bee1f070f1e123)

## Troubleshooting

> [accordion] Every action fails with 401
>
> Check the service user still exists, its token hasn't expired or been regenerated, and you pasted only the token. If in doubt, [renew the token](#renew-the-api-token).

> [accordion] Not-found or connection errors
>
> Management Console URL must start with `https://` and have no trailing `/` or path such as `/dashboard`.

> [accordion] Read actions work but endpoint actions fail (403)
>
> A Viewer can't act on endpoints. Create a service user with Admin or a suitable custom role and paste its token.

> [accordion] Sites are missing from Client Mapping, or agents and threats are missing
>
> Triggr only sees the service user's scope. Create one with Account access, or access to the missing sites, replace the token, then click Refresh on Client Mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.