{
  "name": "SentinelOneV2Connector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "SentinelOneV2Connector",
      "title": "SentinelOne V2 (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The SentinelOne V2 data connector ingests Activities, Agents, Groups and Threats logs from the SentinelOne REST API, and security alerts from the SentinelOne Unified Alert Management (UAM) GraphQL API, into Microsoft Sentinel. It is built on the Microsoft Sentinel Codeless Connector Platform and uses DCR-based ingestion-time transformations. See: [SentinelOne UAM GraphQL API](https://usea1-partners.sentinelone.net/soc-docs/en/unified-alert-management-graphql-api.html)",
      "graphQueries": [
        {
          "metricName": "Total activities logs received",
          "legend": "SentinelOne Activities Logs",
          "baseQuery": "SentinelOneActivities_CL"
        },
        {
          "metricName": "Total agents logs received",
          "legend": "SentinelOne Agents Logs",
          "baseQuery": "SentinelOneAgents_CL"
        },
        {
          "metricName": "Total groups logs received",
          "legend": "SentinelOne Groups Logs",
          "baseQuery": "SentinelOneGroups_CL"
        },
        {
          "metricName": "Total threats logs received",
          "legend": "SentinelOne Threats Logs",
          "baseQuery": "SentinelOneThreats_CL"
        },
        {
          "metricName": "Total alerts (V2) received",
          "legend": "SentinelOne Alerts V2",
          "baseQuery": "SentinelOneAlertsV2_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of SentinelOne activities logs",
          "query": "SentinelOneActivities_CL | take 10"
        },
        {
          "description": "Get sample of SentinelOne agents logs",
          "query": "SentinelOneAgents_CL | take 10"
        },
        {
          "description": "Get sample of SentinelOne groups logs",
          "query": "SentinelOneGroups_CL | take 10"
        },
        {
          "description": "Get sample of SentinelOne threats logs",
          "query": "SentinelOneThreats_CL | take 10"
        },
        {
          "description": "Get sample of SentinelOne alerts (V2)",
          "query": "SentinelOneAlertsV2_CL | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "SentinelOneActivities_CL",
          "lastDataReceivedQuery": "SentinelOneActivities_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "SentinelOneAgents_CL",
          "lastDataReceivedQuery": "SentinelOneAgents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "SentinelOneGroups_CL",
          "lastDataReceivedQuery": "SentinelOneGroups_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "SentinelOneThreats_CL",
          "lastDataReceivedQuery": "SentinelOneThreats_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "SentinelOneAlertsV2_CL",
          "lastDataReceivedQuery": "SentinelOneAlertsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect SentinelOne to Microsoft Sentinel",
          "description": "Configure your SentinelOne API connection. Each instance corresponds to a single SentinelOne Management URL + API Token.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### Configuration steps for the SentinelOne API\nFollow the instructions below to obtain the credentials. Alerts are collected via the [SentinelOne Unified Alert Management GraphQL API](https://usea1-partners.sentinelone.net/soc-docs/en/unified-alert-management-graphql-api.html)."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 1. Retrieve SentinelOne Management URL\n   1.1. Log in to the SentinelOne **Management Console** with Admin user credentials.\n   1.2. In the **Management Console** copy the URL link without the URL path."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. Retrieve API Token\n   2.1. Log in to the SentinelOne **Management Console** with Admin user credentials.\n   2.2. In the **Management Console**, click **Settings**.\n   2.3. In **Settings** view click on **USERS**.\n   2.4. In the **USERS** page click on **Service Users** -> **Actions** -> **Create new service user**.\n   2.5. Choose **Expiration date** and **scope** (by site) and click on **Create User**.\n   2.6. Once the **Service User** is created copy the **API Token** from the page and press **Save**."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 3. Connect new instances\nTo enable the SentinelOne connector for Microsoft Sentinel, click the **Add new instance** button, fill in the required information in the context pane and click on **Connect**."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Management URL",
                    "columnValue": "properties.addOnAttributes.managementUrl"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.addOnAttributes.dataType"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add new instance",
                "title": "SentinelOne connector",
                "subtitle": "Add new instance",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "SentinelOne Management URL",
                          "placeholder": "https://example.sentinelone.net",
                          "type": "text",
                          "name": "managementUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "API Token",
                          "placeholder": "API Token",
                          "type": "password",
                          "name": "apitoken",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}