Skip to main content
The SentinelOne API tool gives Neo agents direct access to the SentinelOne Management API (v2.1). An agent can read the threat behind a ticket, check the endpoint and its timeline, record the verdict, and close the threat in the console. It can also mitigate the threat or isolate the endpoint, on its own or after a technician approves, as you set it.
Automatically enabled when you configure SentinelOne permissions in your agent workflow. No manual toggle needed.
Agents load the SentinelOne API skill first. The skill carries the site scoping rule, the filter and data body shape, and the endpoint tables for threats, alerts, endpoints and response actions.

​
What It Does

  • Read the threat behind a SentinelOne ticket: classification, confidence, file, hashes, storyline, and whether it is already mitigated
  • Read its timeline, notes and storyline events, and the endpoint’s current status
  • Set the analyst verdict and incident status, add notes, and write the PSA ticket number on the threat
  • Read and update STAR alerts, and read unified alerts through Unified Alert Management
  • Find endpoints by name, user, IP or status; run and stop scans; collect logs and files; tag endpoints
  • Mitigate threats, isolate or reconnect endpoints, reboot or shut down
  • Read and change exclusions and the hash blocklist
  • Run Deep Visibility and PowerQuery event searches, and read the console activity log
  • Run a library script on named endpoints

​
Permission Groups

Each group has an access level: Disabled, Read Only, or Read/Write.

​
Access Profiles

All groups Read Only. The agent investigates any threat or endpoint and reports, but never changes anything.
Threats & Alerts and Endpoints at Read/Write, everything else Read Only. The agent triages, mitigates and closes threats on its own. Endpoint actions, such as a scan, isolation or a reboot, require technician approval.
Every writable group at Read/Write. The agent mitigates, isolates, reboots, runs scripts and manages sites and groups autonomously. Exclusion and blocklist changes require technician approval.
Every supported write runs autonomously. Only uninstalling, decommissioning or disabling the SentinelOne agent, and Unified Alert Management changes, require technician approval.

​
Safety Controls

Network isolation is asynchronous. After the call, the endpoint shows disconnecting and then disconnected. The agent is instructed to report an endpoint as isolated only after SentinelOne confirms it.

​
How to Configure

1

Connect SentinelOne

Save your console URL and a service-user API token in the Neo Dashboard under the Security integrations category. See Connecting SentinelOne to Neo.
The service user’s role limits what any agent can do: each API operation needs its own permission. Other MSP tools ask for Viewer to read, and for SOC or IR Team to set verdicts and respond to threats.
2

Configure permissions

In your agent workflow’s Integrations tab, choose an access profile or customize each permission group.
3

Set approval requirements

Decide per permission group whether writes need a technician. Removing or disabling the SentinelOne agent always does.
Start with Read Only to see the threat context an agent brings to each ticket before it changes anything. Helpdesk adds triage, mitigation and closing threats on its own.