Skip to main content
Triggr works with SentinelOne accounts, sites, groups, agents, installed applications and threats, and can scan, disconnect, reconnect, reboot and uninstall endpoints.

​
Set up SentinelOne

Create a service user for Triggr. SentinelOne’s guide is in your console’s built-in help: add /docs/en/creating-service-users.html to your console URL.
1

Start a service user

In the scope selector, select the account or site Triggr should work with. Go to Settings > Users > Service Users (in newer consoles, Policy & Settings > User Management > Service Users) and click Actions > Create New Service User.
2

Name it and set the expiry

Set Name to Triggr and choose the longest Expiration Date your policy allows; you can’t change either later. Click Next.
3

Choose access and role

Set Access Level to Account for every site, or Site for the sites you select. Choose Viewer to only read data, or Admin (or a custom role that allows them) to scan, disconnect, reconnect, reboot or uninstall agents and retrieve uninstall passphrases. Click Create User.
4

Copy the API token

Copy the token before you click Close. SentinelOne shows it only once.

​
Connect it in Triggr

1

Open the configuration

Go to Integrations > SentinelOne and click Configure on the Base Configuration card.
The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.
2

Enter the token and console

Paste the token into API Token, without an ApiToken prefix. Enter your Management Console URL with https:// and nothing after the host name, such as https://usea1-partners.sentinelone.net, and click Save Configuration.
The SentinelOne configuration window with API Token and Management Console URL fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.
One connection covers every site the service user can see.

​
Map your clients

The Client Mapping card lists those sites. Click Apply 100% Matches, then choose the site in Mapped to for any client left. Triggr saves each match as the client’s sentinelOneSiteId variable (and its account as sentinelOneAccountId), for actions’ siteIds and accountIds inputs.
The Client Mapping card with All, Mapped and Unmapped filters, Acme Corp mapped to Acme Corp with a 75% suggested mapping, and Globex unmapped with a Select ConnectWise Manage clients dropdown.

​
Renew the API token

Every action fails once the token expires. Before then, select the Triggr service user and click Actions > Copy User to create a replacement with a new expiry (or Actions > Regenerate API Token, which stops the old token straight away). Then click Edit on the Base Configuration card and paste the new token.
The Base Configuration card with Status Configured, Admin Consent Not Required, and Unlink and Edit buttons.

​
Troubleshooting

Check the service user still exists, its token hasn’t expired or been regenerated, and you pasted only the token. If in doubt, renew the token.
Management Console URL must start with https:// and have no trailing / or path such as /dashboard.
A Viewer can’t act on endpoints. Create a service user with Admin or a suitable custom role and paste its token.
Triggr only sees the service user’s scope. Create one with Account access, or access to the missing sites, replace the token, then click Refresh on Client Mapping.