# HELP, Interconnecting SentinelOne with Elasticsearch

**URL:** <https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774>\
**Category:** SIEM\
**Created:** [May 8, 2023, 12:26am UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774 "2023-05-08T00:26:19Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mdiouf01](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@Mdiouf01](https://discuss.elastic.co/u/Mdiouf01)\
**Post date:** [May 8, 2023, 12:26am UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/1 "2023-05-08T00:26:19Z")

</div>

Hello, I need your help 🥹🥹

I am a SOC analyst, and I want to interconnect SentinelOne with ELK SIEM.  
Could you help me to know if you have a tuto or clear documentation explaining all the steps please?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 8, 2023, 3:52am UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/2 "2023-05-08T03:52:01Z")

</div>

Welcome to our community! 😃

Do you mean [SentinelOne | Elastic docs](https://docs.elastic.co/integrations/sentinel_one)?

---

<div class="post-metadata">

**Author:** ![Mdiouf01](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@Mdiouf01](https://discuss.elastic.co/u/Mdiouf01)\
**Post date:** [May 8, 2023, 10:12am UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/3 "2023-05-08T10:12:09Z")

</div>

Hello ☺, Thank you very much for your answer.

I have already consulted this doc, unfortunately, it just shows how to generate the sentinelone api. But does not show the steps for interconnection.😔

---

<div class="post-metadata">

**Author:** ![sourcreamnormanbates](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\
**Post date:** [May 16, 2023, 12:57pm UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/4 "2023-05-16T12:57:06Z")

</div>

I got this working by deploying the SentinelOne integration to one of my fleet managed Elastic Agents.

---

<div class="post-metadata">

**Author:** ![Mdiouf01](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@Mdiouf01](https://discuss.elastic.co/u/Mdiouf01)\
**Post date:** [May 17, 2023, 1:01am UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/5 "2023-05-17T01:01:36Z")

</div>

Hello,  
Did you manage to make the connection? Following which documentation please? With each necessary step

Thank you in advance

---

<div class="post-metadata">

**Author:** ![sourcreamnormanbates](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\
**Post date:** [May 17, 2023, 4:55pm UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/6 "2023-05-17T16:55:23Z")

</div>

1. Install Elastic Agent on a Windows PC using scripted commands provided when you create an Elastic Agent integration [Install Fleet-managed Elastic Agents | Fleet and Elastic Agent Guide [8.7] | Elastic](https://www.elastic.co/guide/en/fleet/current/install-fleet-managed-elastic-agent.html) (If you are in a test environment without certificates setup, you will have to add --insecure to the last command)
2. Troubleshoot any issues with the agent until it has a status of Healthy and you see CPU and Memory usage reported
3. Deploy the SentinelOne integration and choose the same agent policy as the one used by the Elastic Agent
4. If that doesn't work, run .\elastic-agent inspect and make sure the outputs shown are correct. I had to modify the Fleet settings to update with the correct hosts [Fleet UI settings | Fleet and Elastic Agent Guide [8.7] | Elastic](https://www.elastic.co/guide/en/fleet/current/fleet-settings.html)

---

<div class="post-metadata">

**Author:** ![Mdiouf01](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@Mdiouf01](https://discuss.elastic.co/u/Mdiouf01)\
**Post date:** [May 23, 2023, 12:11pm UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/7 "2023-05-23T12:11:34Z")

</div>

Thank you a lot for your answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2023, 12:11pm UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774/8 "2023-06-20T12:11:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.