--- title: Connecting SentinelOne description: "To attach SentinelOne to your instance of Prelude, you will need 3 items: You can attach SentinelOne using the PreludeCLI or the Detect console Prelude CLI Detect Console Navigate to integrations page" --- [Skip to content](https://support.preludesecurity.com/docs/sentinelone#main-content) English Show submenu for translations [Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en) ![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png) Open main navigation Close main navigation - English Show submenu for translations - [Contact support](https://support.preludesecurity.com/kb-tickets/new) - [Visit the website](https://www.preludesecurity.com/) [Visit the website](https://www.preludesecurity.com/) Find what you're looking for - There are no suggestions because the search field is empty. 1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en) 2. [Monitor](https://support.preludesecurity.com/monitor?hsLang=en) 3. [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations) # Connecting SentinelOne To attach SentinelOne to your instance of Prelude, you will need 3 items: - Base URL - (IE: [https://usea1-partners.sentinelone.net/](https://usea1-partners.sentinelone.net/)) - Account ID - API Secret You can attach SentinelOne using the PreludeCLI or the Detect console **Prelude CLI** ``` prelude partner attach sentinelone --api --user --secret ``` **Detect Console** Navigate to integrations page by clicking your username in the top right -\> Account Settings -\> Integrations: **Obtain BaseURL** You can obtain the base url from your SentinelOne instance browser window or follow the directions below. 1. Login to SentinelOne 2. Click on Help -\> API Doc 3. Expand Accounts -\> Click on Create Account 4. Click run on console 5. Click Run API query 6. The URL will be displayed. Click Copy URL. An example provided URL: [https://usea1-partners.sentinelone.net/web/api/v2.1/accounts](https://usea1-partners.sentinelone.net/web/api/v2.1/accounts) Remove everything after the .net: [https://usea1-partners.sentinelone.net](https://usea1-partners.sentinelone.net) **Obtain Account ID** 1. Login to SentinelOne and navigate to Account Scope 2. Select the Sentinels page 3. Click on "Account Info" 4. The Account ID is displayed. Copy Account ID **Obtain API Secret** Option 1: Create a custom role and service account for the Prelude Integration 1. Navigate to Settings -\> Users -\> Roles 2. Create new role for Prelude Integration with the following permissions scoped to the Account - Endpoints - View - Endpoint Threats - View - Update Incident Status - Update Analyst Verdict - Endpoint Policy - View 3. Create new service account using the role created above and copy/save the token securely, this token will not be available to view again without creating a new one. ### Option 2: User Account API Token 1. Login to Sentinel One 2. Click on Settings 3. Click on Users tab 4. Click on your console user -\> you’ll see a modal for the selected user 5. Click on the Actions drop down -\> API Token Operations -\> Generate API token Your API Token is displayed. Copy and save the token securely, this token will not be available to view again without creating a new one. - [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content) - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor) - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration) - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations) - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations) - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations) - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations) - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations) - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations) - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations) - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting) - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting) - [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content) - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics) - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations) - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment) - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests) - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression) - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance) - [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content) - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase) - [Account](https://support.preludesecurity.com/account?hsLang=en#main-content) - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso) - [CLI](https://support.preludesecurity.com/cli?hsLang=en) - [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en) [![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com) Prelude Security Knowledge Base Copyright © 2026, Origin Technology