---
title: Suppressing alerts in Sentinel One
description: Alert management can be performed automatically through a SentinelOne’s XDR Webhook with Prelude’s API. Get your Webhook authentication material from Prelude, this can be done via the Detect UI or Pre
---

[Skip to content](https://support.preludesecurity.com/docs/sentinel-one#main-content)

English

Show submenu for translations

[Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en)

![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact support](https://support.preludesecurity.com/kb-tickets/new)
- [Visit the website](https://www.preludesecurity.com/)

[Visit the website](https://www.preludesecurity.com/)

 Find what you're looking for

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en)
2. [Detect](https://support.preludesecurity.com/detect?hsLang=en)
3. [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression)

# Suppressing alerts in Sentinel One

Alert management can be performed automatically through a SentinelOne’s XDR Webhook with Prelude’s API.

1. Get your Webhook authentication material from Prelude, this can be done via the Detect UI or Prelude CLI. Save generate-webhook output to be used in the following steps. To generate the webhook:
2. **PreludeCLI**: `prelude partner generate-webhook SENTINELONE`
3. **Detect UI**: Navigate to upper right corner and click on your username. Next, select "Integrations" and click "Settings" next to SentinelOne.
4. Go the SentinelOne Singularity Martketplace and search for Webhook:

![](https://support.preludesecurity.com/hubfs/Knowledge%20Base%20Import/49098b4-image.png)

1. Click “Configure” and paste in your:
2. **API** - (from step 1) - [https://api.us1.preludesecurity.com/partner/suppress/4/\*\*account\_number\*\*](https://api.us1.preludesecurity.com/partner/suppress/4/**account_number**)
3. **Secret** - (from step 1) -
4. **Description** - sentinelone-webhook-auth
5. **Headers:** `Text JSON { "Accept": "application/json", "Content-Type": "application/json", "Token": "${Var1}" }`
6. **Custom Body Message:**
7. \`\`\`Text JSON {"incidentStatus":"${activity.threatInfo.incidentStatus}", "threatId":"${activity.threatInfo.threatId}", "sha1":"${activity.threatInfo.sha1}", "threatName":"${activity.threatInfo.threatName}", "originatorProcess":"${activity.threatInfo.originatorProcess}"}
   
   \`\`\`

![](https://support.preludesecurity.com/hubfs/Knowledge%20Base%20Import/07552ce-image.png)

1. Click Save and set your Scope of Access to your Account & Site ID for which you’ve enabled your Prelude Partner integration.
2. Install to your specified site.
3. Done!

- [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content)

    - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor)
    - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration)
    - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations)
    - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations)
    - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations)
    - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations)
    - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations)
    - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations)
    - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations)
    - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting)
    - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting)
- [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content)

    - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics)
    - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations)
    - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)
    - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests)
    - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression)
    - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance)
- [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content)

    - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase)
- [Account](https://support.preludesecurity.com/account?hsLang=en#main-content)

    - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso)
- [CLI](https://support.preludesecurity.com/cli?hsLang=en)
- [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en)

[![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com)

Prelude Security Knowledge Base

Copyright © 2026, Origin Technology