SentinelOne

Last updated Apr 17, 2026Copy as MarkdownView as MarkdownAgent setup

OverviewPrerequisitesSet up SentinelOne as a service provider1. Obtain SentinelOne settings2. Add SentinelOne as a service provider3. Configure the posture checkDevice posture attributesDetect user risk behavior

Cloudflare One can integrate with SentinelOne to require that users connect to certain applications from managed devices. This service-to-service posture check uses the Cloudflare One Client to read endpoint data from SentinelOne. Devices are identified by their serial numbers. If multiple devices have the same serial number, Cloudflare cannot accurately match a device with a third-party provider device. You must ensure that each of your devices has a unique serial number.

Prerequisites

SentinelOne agent is deployed on the device.
Cloudflare One Client is deployed on the device. For a list of supported modes and operating systems, refer to Service providers.

Set up SentinelOne as a service provider

1. Obtain SentinelOne settings

The following SentinelOne values are needed to set up the SentinelOne posture check:

API Token
REST API URL

To retrieve those values:

Log in to your SentinelOne Dashboard.
Go to Settings > Users > Create new Service User.
Select Create New Service User.
Enter a Name and Expiration Date and select Next.
Set Scope of Access to Viewer.
Select Create User. SentinelOne will generate an API Token for this user.
Copy the API Token to a safe location.
Select Close.
Copy the Rest API URL from your browser's address bar (for example, https://<S1-DOMAIN>.sentinelone.net).

2. Add SentinelOne as a service provider

In the Cloudflare dashboard , go to Zero Trust > Integrations > Service providers.
Select Add new.
Select SentinelOne.
Enter any name for the provider. This name will be used throughout the dashboard to reference this connection.

In Client Secret, enter your API Token.
In Rest API URL, enter https://<S1-DOMAIN>.sentinelone.net.
Choose a Polling frequency for how often Cloudflare One should query SentinelOne for information.
Select Test and save.

3. Configure the posture check

In the Cloudflare dashboard , go to Zero Trust > Reusable components > Posture checks > Service provider checks.
Select Add a check.
Select the SentinelOne provider.
Enter any name for the posture check.
Configure the attributes required for the device to pass the posture check.
Select Save.
To test, go to Insight > Logs > Posture logs and verify that the service provider posture check is returning the expected results.

You can now use this posture check in a device posture policy.

Device posture attributes

Device posture data is gathered from the SentinelOne Management APIs. For more information, refer to https://<S1-DOMAIN>.sentinelone.net/api-doc/overview.

Selector	Description
Infected	Whether the device is infected
Active Threats	Number of active threats on the device
Is Active	Whether the SentinelOne Agent is active
Network status	Whether the SentinelOne Agent is connected to the SentinelOne service
Operational State	The operational state of the SentinelOne Agent.

Detect user risk behavior

SentinelOne provides endpoint detection and response (EDR) signals to determine user risk score. User risk scores allow you to detect users that present security risks to your organization. For more information, refer to Predefined risk behaviors.

PreviousMicrosoft Endpoint Manager NextTanium

Was this helpful?

YesNo

Edit page Report issue