Setting up SentinelOne webhooks

The following information is provided to help you set up webhooks for SentinelOne.

As a summary, you need to create a SentinelOne XDR API key, create the XDR API URL that FortiDLP will send payloads to, and then create a SentinelOne webhook configuration in FortiDLP.

We advise that you read Creating webhooks ahead of completing this setup if you have not created a webhook configuration before. SentinelOne webhook payloads can only be generated for detection events, and are always batched.

How to create a SentinelOne XDR API key and URL

1. In the SentinelOne Singularity Platform, create a new XDR Log Access API Key with "Write" access, and keep a note of it.
   

   For information on how to create the API key, refer to SentinelOne's documentation and navigate to Singularity Data Lake (Skylight Visibility Enhanced)> API > API - General > XDR API Keys.

2. Create your XDR API URL by using https://<yourConsole.net>/api/addEvents as a template, replacing <yourConsole.net> with your Singularity Data Lake URL, and keep a note of it.
   

   For example, https://xdr.us1.sentinelone.net/api/addEvents.

How to create a SentinelOne webhook configuration in FortiDLP

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Under Integrations, select the Webhooks tab.
3. Click Create new webhook.
4. In the URL field, paste the XDR API URL that you created at step 2 of How to create a SentinelOne XDR API key and URL.
5. In the Payload format field, select SentinelOne.
6. In the Headers field, paste Authorization: Bearer <YOUR_XDR_LOG_ACCESS_API_KEY>, replacing <YOUR_XDR_LOG_ACCESS_API_KEY> with the key you created at step 1 of How to create a SentinelOne XDR API key and URL.
7. Configure the other fields as needed.
8. Click Create.