Connect Qevlar to SentinelOne to investigate endpoint threats with process, file, registry, network, and Deep Visibility context. This page lists the permissions Qevlar requires and how to grant them.
Overview
Qevlar authenticates to SentinelOne with an API token sent as Authorization: ApiToken <token> — no user sign-in per request. The token inherits the role and scope of the user it is generated for, which is what governs access. The connector is read-only: it reads threats and their events and verifies existing mitigations, but never triggers response actions.
| API | Purpose | Auth |
|---|---|---|
| SentinelOne management API (v2.1) | Read agents, threats, and Deep Visibility threat events | API token |
The API base is your management console: https://{siteId}.sentinelone.net/web/api/v2.1/.
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Site ID | The subdomain of your console URL, e.g. euce1-123 from https://euce1-123.sentinelone.net | Yes |
| API Token | Generated for a user or service user in the console (shown once) | Yes |
Enter the Site ID as the subdomain only — without https:// or .sentinelone.net.
Required permissions
SentinelOne grants API access through the role and scope of the user that owns the token. Generate the token for a service user (recommended for integrations, as it is not tied to a person) with a read-only role.
| Setting | Value | Why |
|---|---|---|
| Role | Viewer (or a custom read-only role) | Grants read access to endpoints, threats, and Deep Visibility events |
| Scope | Account, or the relevant Site / Group | Determines which endpoints and threats Qevlar can investigate |
If you use a custom role instead of Viewer, it must allow viewing: Endpoints / Agents, Threats, and Deep Visibility (event search). No response or write permissions are needed.
Setup
- Create a service user. In the SentinelOne console, go to Settings → Users → Service Users → Create New Service User. Set its scope to Account, or to the relevant Site or Group.
- Assign a read-only role. Apply the Viewer role, or a custom role with Endpoints/Agents, Threats, and Deep Visibility view permissions.
- Generate the API token. Copy the token immediately — it is shown only once. Note its expiry and plan to rotate it before it lapses.
- Get the Site ID. Take the subdomain from your console URL, e.g.
euce1-123fromhttps://euce1-123.sentinelone.net. - Configure the connector. In Qevlar, add the SentinelOne connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check that lists agents (Endpoints/Agents view). If it fails, check, in order:
- The token's role grants Endpoints/Agents, Threats, and Deep Visibility view permissions.
- The token has not expired.
- The Site ID is the console subdomain only, without
https://or.sentinelone.net. - The user's scope covers the threats you want to investigate.
API reference
| Operation | HTTP | Endpoint |
|---|---|---|
| List agents (health check) | GET | /web/api/v2.1/agents |
| Read threats | GET | /web/api/v2.1/threats |
| Read threat events (Deep Visibility) | GET | /web/api/v2.1/threats/{threatId}/explore/events |
| Fetch mitigation report | GET | /web/api/v2.1/{reportPath} |
Base URL: https://{siteId}.sentinelone.net · auth header: Authorization: ApiToken <token>.