>
    Strata Copilot
    Set up SentinelOne Singularity Endpoint for Integration
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Device Security Integration Guide
    4. Endpoint Protection
    5. Integrate Device Security with SentinelOne Singularity Endpoint
    6. Set up SentinelOne Singularity Endpoint for Integration
    Download PDF
    Device Security

    Set up SentinelOne Singularity Endpoint for Integration

    Table of Contents

    Set up SentinelOne Singularity Endpoint for Integration

    Configure SentinelOne Singularity Endpoint to generate an API token for integration with Device Security.
    Where Can I Use This?What Do I Need?
    • Device Security (Managed by Strata Cloud Manager)
    • (Legacy) IoT Security (Standalone portal)
    One of the following subscriptions:
    • Device Security subscription
    • Precision AI bundle subscription
    • Device Security X subscription
    One of the following Cortex XSOAR setups:
    • A free, cohosted, limited-featured Cortex XSOAR instance
      AND
      A free Cortex XSOAR Engine (on-premises integration)
    • A full-featured Cortex XSOAR server
    It's assumed you already have SentinelOne Singularity Endpoint set up. When integrating SentinelOne with Device Security and Cortex XSOAR, you need to provide Cortex XSOAR with an API token from SentinelOne. Cortex XSOAR uses the API token to poll SentinelOne for information about endpoints and vulnerabilities.
    To generate the API token from SentinelOne, create a SentinelOne role for Cortex XSOAR to use. Then assign the role to a service user in SentinelOne to generate the API token.
    1. Log in to your SentinelOne Singularity console with an account that has administrator privileges.
    2. Navigate to Settings Users to open the user management page.
    3. Select the Roles view, and then click Actions New Role to create a role for Cortex XSOAR to use.
      1. Provide a Role Name to help you identify the service role.
      2. Add permissions to the role so that it can access the information needed for the integration with Device Security.
        1. Search for the Endpoints page and select View permission.
        2. Search for the Applications page and select View and View Risks permissions.
      3. Save the new role.
        This brings you back to the Users page.
    4. Select the Service Users view, and then click Actions Create New Service User to create the service user for Cortex XSOAR.
      1. Provide a Name to help you identify the service user for Cortex XSOAR.
      2. Configure an Expiration Date that meets your needs for security and usability.
        Minimizing the API token expiration duration provides better security, but requires you to regenerate the API token each time you run the integration job. If you plan to run the integration job frequently or on a recurring schedule, consider extending the API token expiration duration.
      3. Click Next to go to the Select Scope of Access screen.
      4. Select the Access Level. The access level controls the scope of how much information Device Security learns from SentinelOne.
      5. Select the role you created previously as the account for the service user.
      6. Create User to generate the API token.
    5. Copy API Token for the user role and save it in a secure location.
      After you close the workflow, you cannot view the API token again. If you forget the API token, you will need to generate a new one and update the integration instance in Cortex XSOAR.
    6. Close the Service User and API Token creation workflow.

    © 2026 Palo Alto Networks, Inc. All rights reserved.