> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/getting-started/onboarding/connectors/sentinelone.md).

# SentinelOne

This guide will instruct you on how to create a role and API token then how to give the SOC analyst access.

## <mark style="color:$primary;">Creating a Role and API Token</mark>

### <mark style="color:$primary;">Step 1: Creating Role</mark>

Log in to the SentinelOne platform and go to **Settings > Users**

<figure><img src="/files/QumxYQzksR2IVPFojU9g" alt=""><figcaption></figcaption></figure>

Click to **Action > New Role >** Give the role the name CybaOps and add the following roles:

* **Endpoints**
  * View
  * View Threats
* **Endpoints Threats**
  * View
  * Xdr Actions
* **SDL Alerts (previously Skylight)**
  * View
* **STAR Rule Alerts**
  * View
* **Unified Alerts**
  * Select all

### <mark style="color:$primary;">Step 2: Creating Service User</mark>

Go to **Service Users > Actions > Create New Service User**

<figure><img src="/files/FjLpv5osYumzGOw2B0OX" alt=""><figcaption></figcaption></figure>

Give it the name CybaOps and set the Expiration to 2 years. Select **Scope of Access to Site** and choose the site you want to give API permission, changing the role to the one you created and called CybaOps.

<figure><img src="/files/r8Pxf8hGc2LtsV2xYaoL" alt=""><figcaption></figcaption></figure>

Click on Create User.

### <mark style="color:$primary;">Step 3: Add to CybaOps</mark>

Copy the API token of the CybaOps user and your platform URL: [https://yourConsole.net/](< https://yourConsole.net/  >) and paste into CybaOps.

<figure><picture><source srcset="/files/vPkJ4d0rk914nmvE40NV" media="(prefers-color-scheme: dark)"><img src="/files/ugEcjOlNbPazrlpASnoV" alt=""></picture><figcaption></figcaption></figure>

## <mark style="color:$primary;">Give the SOC Analyst Access</mark>

This will be outlined during your onboarding call.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybaops.com/getting-started/onboarding/connectors/sentinelone.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.