Skip to main content
Who is this for? Workspace Admins or Security Engineers who manage a workspace that uses SentinelOne Singularity. This guide walks you through creating two SentinelOne Service Users, configuring both modules in ContraForce, and verifying that threats flow end-to-end.

​
Before You Begin

​
What These Modules Do

SentinelOne integrates with ContraForce through two separate modules:

Detection Module

Threat ingestion and investigation
  • Polls the SentinelOne Threats API for new threats
  • Classifies them as ContraForce Incidents or Detections
  • Round-trips status changes and analyst notes back to SentinelOne
  • Records incident ownership in ContraForce (not written back to SentinelOne)

Response Module

Gamebook response actions
  • Powers Contain and Lift Containment Gamebooks (Network Quarantine)
  • Powers On-Demand Scan Gamebooks
  • Required for any Gamebook that acts on a SentinelOne-managed endpoint
The two modules use separate SentinelOne Service Users so each has only the role it needs.
Incident ownership is tracked in ContraForce, not in SentinelOne. A SentinelOne threat has no owner or assignee property, and analysts working through a service provider rarely hold an account in the customer’s SentinelOne tenant. Assigning an owner in ContraForce therefore records the assignment in ContraForce, where every user who can see the incident can see who owns it. The SentinelOne console will continue to show the threat with no assignee.Status changes and analyst notes are unaffected — those still round-trip to SentinelOne. Unlike the CrowdStrike module, there is no option to mirror ownership to the vendor, because SentinelOne has no field to write it to.

​
Prerequisites

1

SentinelOne Singularity subscription

An active SentinelOne Singularity subscription with endpoint agents deployed and reporting to the management console.
2

SentinelOne admin access

Access to Settings → Users → Service Users in the SentinelOne console. Creating Service Users typically requires the SentinelOne Admin role at the scope you plan to integrate.
3

ContraForce workspace

A ContraForce workspace created for the tenant, with your account assigned the Workspace Admin role.
4

Your SentinelOne Management Console URL

Identify the full URL of your SentinelOne management console (for example, https://yourtenant.sentinelone.net). You will enter this as the Endpoint when configuring the Detection module.
You can confirm the Management Console URL by logging in to SentinelOne — the base URL in your browser (without any path after the hostname) is the value you will use. Do not include a trailing slash.

​
Scope of Access

SentinelOne scopes roles by Global → Account → Site → Group. For most integrations, set the scope of each Service User to Site and pick the specific sites you want ContraForce to monitor. Use Account only if ContraForce should cover every site in the account.

​
Step 1 — Create the Detection Service User in SentinelOne

  1. In the SentinelOne console, navigate to Settings → Users → Service Users
  2. Click Actions → Create New Service User
  3. Set Name to ContraForce Detection
  4. Set Description to ContraForce threat ingestion and status writeback
  5. Set Scope of access to Site (pick the sites ContraForce will monitor) or Account if all sites are in scope
  6. Assign the built-in role SOC
  7. Set an expiration date for the API token — SentinelOne supports up to 1 year. Pick a date that fits your rotation policy
  8. Click Create
SentinelOne will display the API Token on the confirmation screen.
The API Token is shown once at creation time and cannot be retrieved later. Copy it to a secure location immediately. If you lose it, you must regenerate the token from the same Service User.
If your organization doesn’t use the built-in SOC role, you can create a custom role with the following permissions instead: Threats (View, Modify), Threat Notes (View, Add, Edit, Delete), and Activity (View).

​
Step 2 — Create the Response Service User in SentinelOne

Repeat the process for a second Service User that ContraForce will use for Gamebook response actions.
  1. In Settings → Users → Service Users, click Actions → Create New Service User
  2. Set Name to ContraForce Response
  3. Set Description to ContraForce Gamebook response actions
  4. Set Scope of access to match the Detection Service User
  5. Assign the built-in role IR Team
  6. Set an expiration date and click Create
Copy the API Token for the Response Service User.
If your organization doesn’t use the built-in IR Team role, you can create a custom role with the Detection permissions above plus Endpoints / Agents (View, Disconnect, Reconnect, Initiate Scan).
Creating two separate Service Users — one with SOC for Detection, one with IR Team for Response — follows the principle of least privilege. The Detection user can’t disconnect an endpoint, and the Response user doesn’t get more threat access than it needs.

​
Step 3 — Configure the SentinelOne Detection Module in ContraForce

  1. In the ContraForce portal, navigate to Workspaces → your workspace → Modules
  2. Locate the SentinelOne Detection card and click Configure
  3. Fill in the following fields:
  1. Click Test Connection to verify the credentials reach SentinelOne and have the required permissions
  2. Click Configure and Save
If Test Connection fails, see the Troubleshooting table before saving.

​
Step 4 — Configure the SentinelOne Response Module in ContraForce

  1. On the same Modules page, locate the SentinelOne Response card and click Configure
  2. Fill in the following fields:
  1. Click Test Connection and then Configure and Save
A successful test means Gamebook response actions are ready for SentinelOne-managed endpoints.

​
Step 5 — Verify End-to-End

1

Wait for the first poll cycle

The Detection module polls SentinelOne on a short interval. New threats appear in ContraForce within a few minutes of being generated in SentinelOne.
2

Check the Command Dashboard

Navigate to the Command Dashboard. SentinelOne threats should appear alongside incidents from other sources.
3

Open an incident

Click into a SentinelOne-sourced incident and verify that the Entities and Timeline tabs are populated with threat data.
4

Try a Gamebook (optional)

If the Response module is configured, open a SentinelOne incident where the affected entity is an agent and confirm that Contain, Lift Containment, and On-Demand Scan Gamebook actions are available.

​
What Each Module Unlocks

You can configure the Detection module without the Response module if you don’t need Gamebook response actions for SentinelOne endpoints. Configuring only the Response module without Detection is not a supported configuration — you’d have no incidents for the Gamebooks to run on.

​
Troubleshooting

​
Rotating an API Token

SentinelOne API tokens expire (up to 1 year). Plan to rotate before expiration.
  1. In SentinelOne, navigate to Settings → Users → Service Users
  2. Open the affected Service User (Detection or Response)
  3. Click Actions → Regenerate API Token
  4. Copy the new token immediately — it is only shown once
  5. In ContraForce, reopen the affected module (Detection or Response)
  6. Paste the new token into API Token and click Configure and Save
  7. Click Test Connection to verify

What are Gamebooks?

Learn how Gamebook response actions work

Incident Management

Triage and resolve incidents in ContraForce

Entity Insights

Explore investigation context for an incident’s entities

Roles and Permissions

Detailed role reference for ContraForce users
Questions about connecting SentinelOne to ContraForce? Contact us at support@contraforce.com.