Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-sentinelone-singularity

SentinelOne Singularity Endpoint

You can integrate SentinelOne Singularity with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

SentinelOne Singularity product overview

SentinelOne Singularity is an AI-driven endpoint security solution designed to autonomously defend against a wide spectrum of attacks. By unifying endpoint protection, detection, response, and remediation, it offers a holistic view of the threat landscape and the ability to take immediate action.

What we ingest

Sophos XDR collects endpoint telemetry and security alerts from SentinelOne Singularity over HTTPS by polling the MGMT API of your SentinelOne Management server. We use the following MGMT APIs:

  • Threats

    • Get Threats (GET /web/api/v2.1/threats): Retrieves threat events.
    • Get Events (GET /web/api/v2.1/threats/{threat_id}/explore/events): Retrieves other events related to identified threat events.

  • Assets

    • Get Agents (GET /web/api/v2.1/agents): Retrieves the inventory of SentinelOne agents (endpoints) enrolled in the integrated account or site.

  • Alerts

    • Get Cloud Detection Alerts (GET /web/api/v2.1/cloud-detection/alerts): Retrieves STAR custom rule alerts and their related events.

Sophos XDR polls the MGMT API periodically, with each poll requesting events created during a recent time interval, and the time intervals advancing progressively between the polls. Sophos XDR uses MGMT API pagination to retrieve all events in each time interval.

Sophos XDR authenticates to the MGMT API using service user API tokens.

In addition to the data collected through the MGMT API, Sophos XDR ingests endpoint detection and response (EDR) telemetry through SentinelOne Cloud Funnel 2.0. Unlike the MGMT API data sources, this data is delivered directly to Sophos rather than polled. After you configure a SentinelOne Deep Visibility policy and turn on the EDR data source, SentinelOne Cloud Funnel writes EDR event data to a Sophos-managed storage location, and Sophos XDR ingests and normalizes the data as it arrives. When you turn on the EDR data source, Sophos XDR automatically configures the Cloud Funnel destination.

Event and data types

We ingest the following event and data types from SentinelOne Singularity:

  • Threat events: Primarily generated by SentinelOne agent engines when they detect suspicious or malicious activity. Threat events can also be generated when a user marks events as threats using the API, event search, or custom rules. Threat events are normalized to third-party security alert telemetry and antivirus telemetry, depending on threat classification. Related events are normalized to various telemetry types as listed in the next section.
  • Asset records: The inventory of SentinelOne agents (endpoints) for the integrated account or site, including host and agent details reported by SentinelOne.
  • STAR custom rule alerts: Alerts raised by SentinelOne STAR custom rules. Alerts are normalized to third-party security alert telemetry. Related events are normalized to various telemetry types as listed in the next section.
  • EDR events: Raw endpoint telemetry generated by SentinelOne agents and collected through Cloud Funnel 2.0. These events are normalized to various telemetry types as listed in the next section.

Data provided by this integration

Data provided by SentinelOne Singularity gets normalized to the following schemas:

  • antivirus
  • apicall
  • asset
  • auth
  • dns (related events)
  • filemod (related events)
  • generic
  • http (related events)
  • netflow (related events)
  • persistence (related events)
  • process (related events)
  • processmodule
  • registry (related events)
  • scriptblock
  • thirdpartyalert
  • threadinjection

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation