Connect SentinelOne to Conduit

This walkthrough connects SentinelOne (endpoint protection / EDR) to Conduit. SentinelOne needs two values: an API token and your management console URL — every SentinelOne tenant lives on its own console address, so Conduit can’t guess it.

Menu labels can change

The SentinelOne steps below reflect current console flows; labels can shift between releases. If a label differs, see this guide to understanding SentinelOne API tokens.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A SentinelOne management console login that can generate an API token.
• Your console URL — look at the address bar when you’re signed in to SentinelOne. It looks like https://your-console.sentinelone.net. Copy it exactly (scheme and host, no trailing path); the API token only works against the console it was issued on.

Step 1 — Create an API token in SentinelOne

1. Sign in to your SentinelOne management console. Expected: the SentinelOne dashboard.
2. Generate an API token for your user, following the SentinelOne API tokens guide. Expected: a token value, shown at creation.
3. Copy the token immediately — SentinelOne shows it only once.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, regenerate it in SentinelOne first; the exposed token becomes useless immediately.

Step 2 — Copy your console URL

While signed in to SentinelOne, copy the address from your browser’s address bar — just the origin, for example https://your-console.sentinelone.net. Two things matter:

• Copy it from the address bar, don’t type it from memory — tenants are spread across many console hosts, and a near-miss fails validation.
• It must be reachable from the internet. Conduit’s servers call the console directly to validate and to serve tool calls. Addresses that point at localhost, private IP ranges, or cloud metadata endpoints are rejected before any request is made.

Step 3 — Connect SentinelOne in Conduit

1. In Conduit, go to Connections (/org/catalog), find SentinelOne (under Security), click Connect. Expected: a credential form with two fields.
2. Fill the fields:
   • API Token (required) — from Step 1.
   • Console URL (required) — from Step 2 (placeholder https://your-console.sentinelone.net).
3. Click Connect. Expected: Conduit validates the token against your console immediately and shows a green Connected status. A bad token or wrong console URL is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this SentinelOne connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only SentinelOne tool, such as listing threats or agents. You should get real data back, and the call appears in your audit log with the correct user, vendor (sentinelone), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid SentinelOne API token or console URL.”	Either the token is wrong/expired/revoked, or the Console URL doesn’t match the console the token was issued on. Re-copy the URL from your browser’s address bar and regenerate the token if in doubt.
Connect fails with “SentinelOne returned HTTP <status>.”	The console answered with a non-auth error — usually a transient vendor-side issue or maintenance window. Wait and retry.
Console URL is rejected before SentinelOne is even contacted	The URL points at a non-public address (localhost, a private IP range, or a metadata endpoint). Conduit blocks these; enter the public console address from your browser’s address bar.
Tool calls return 403 “no credentials for vendor”	SentinelOne isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Need to rotate the token	Generate a new API token in SentinelOne, then update the credential at /org/catalog. The old token stops working when regenerated.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.