> For the complete documentation index, see [llms.txt](https://docs.adaptiva.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptiva.com/patch/integrations/integrate-sentinelone.md).

# SentinelOne

You can configure OneSite Patch to collect vulnerability metadata from your SentinelOne site. You can use this metadata to:

* Configure patch filters in simple strategies.
* Set a trigger to rerun an advanced strategy based on changes to specific metadata.
* Configure patch deployment bots to deploy patches based on the metadata.

For a full list of imported values from SentinelOne, please see the [Metadata properties](#metadata-properties) section below.

### Prerequisites

#### Add SentinelOne license key

To enable SentinelOne integration, you will need a license key. For more information about acquiring these keys, please reach out to your Sales manager.

You can add and view your license keys in the Adaptiva Admin Portal. Please see [License your Adaptiva solution](https://docs.adaptiva.com/platform-guide/license-solution#add-a-license) page for more details.

#### Internet connectivity to the SentinelOne API server

You must make sure that the Adaptiva server can access the SentinelOne API server. This enables the Adaptiva server to:

* Verify and save your SentinelOne access settings.
* Regularly download updates to the vulnerability metadata.

You can see the integration section of [Plan for OneSite platform installation](https://docs.adaptiva.com/platform-install/planning-guides/onesite-platform-planning#integrations) for a list of the URLs you must add to your allowlist.

### Enable SentinelOne integration with OneSite Patch

To enable SentinelOne integration, you will need to add either your *OneSite Patch for SentinelOne* or *SentinelOne add-on for OneSite Patch* license from Adaptiva.

You can add and view your license keys in the Adaptiva Admin Portal. See **License your Adaptiva products** for details.

### Create your SentinelOne API token

You will need to create a Service User with Viewer permissions to your site and generate an API token to provide read access from OneSite Patch.

{% hint style="info" %}
Always check the SentinelOne documentation for the latest information on using API tokens for service access.
{% endhint %}

1. Sign in to the SentinelOne Management Console as an administrator.
2. In the Management Console, click **Settings**.
3. In the **Settings** view, click **Users**.
4. Click **Service Users**.
   * Use service users to create API tokens that are not linked to a specific Console user and email address.
5. Click **Actions | Create New Service User**.
6. Create a new service user with the name of **Adaptiva Service User** and an expiration date.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Review the expiration settings with your security administrator and pay attention to the expiration date.</p></div>
7. Click **Next**.
8. On the Select Scope of Access page, select the **Access Level** and **Permissions** for the user (ex. \[*Site Name*]: Viewer).
9. Click **Create User**.
10. In the API Token for Adaptiva Service User dialog, click **Copy API Token**. Save this token for later configuration in the Adaptiva Admin Portal

    <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>This is the only time you can view the token, be sure to save it!</p></div>
11. Click **Close**.

### Configure SentinelOne access in the Adaptiva Admin Portal

1. Log in to the Adaptiva Admin Portal.
2. Select **OneSite Patch**.
3. In the left navigation menu, select **SentinelOne**.

   ![Screenshot of the SentinelOne access settings page](/files/7OYI5d7HEp1WUSIWMqPC)
4. Configure the following settings:

   a. **Host**: Your SentinelOne host name, in the format `https://<region>.sentinelone.net`.

   b. **API Key**: Your API key from the SentinelOne management console.

   c. **Vulnerability Data Reset Schedule**: We recommend that your schedule is at least a recurring weekly schedule. If none of the preset schedules meet your needs, you can create your own schedule by following the instructions at [Create a Custom Schedule](https://docs.adaptiva.com/platform-guide/platform-features/schedules#create-a-custom-schedule).
5. Click the **More** dropdown and select **Test Settings** to make sure that your settings are valid and that the Adaptiva server can connect to SentinelOne. Any connection errors are recorded in the server error logs.
6. Select **Save**.

### Metadata properties

These metadata properties can be used to filter patches when creating patch strategies.

| Property                       | Description                                                                                                                                                                                            | Values                                                                 |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| SentinelOne.KnownExploitExists | SentinelOne's indication of whether or not a known exploit exists for the vulnerability that this Object fixes.                                                                                        | true / false                                                           |
| SentinelOne.ExploitedInTheWild | Indicates if this vulnerability has been successfully exploited in a production environment.                                                                                                           | true / false                                                           |
| SentinelOne.Score              | The MITRE-assigned risk score for this vulnerability.                                                                                                                                                  | Decimal value 0.0 to 10.0, 1 decimal place                             |
| SentinelOne.EpssScore          | The Exploit Prediction Scoring System (EPSS) score which is a probability score between 0 and 1 (0 and 100%). The higher the score the greater the probability that a vulnerability will be exploited. | Decimal value 0.0 to 1.0, 1 decimal place                              |
| SentinelOne.ExploitMaturity    | The maturity of any exploit that exists for this vulnerability.                                                                                                                                        | Unproven / Maturity not defined / Proof of concept / Functional / High |
| SentinelOne.RemediationLevel   | The status of any available remediations for this vulnerability.                                                                                                                                       | Official fix / Temporary fix / Workaround / Not defined / Unavailable  |
| SentinelOne.ReportedConfidence | The confidence SentinelOne has that this vulnerability is present in the client's environment.                                                                                                         | Unknown / Not defined / Reasonable / Confirmed                         |
| SentinelOne.RiskSeverity       | The severity SentinelOne has assigned to this vulnerability.                                                                                                                                           | Critical / High / Medium / Low / Unknown                               |