# SentinelOne Integration with ELK **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-security, filebeat\ **Created:** [February 5, 2026, 6:17am UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924 "2026-02-05T06:17:55Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Jayesh\_Auti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jayesh_auti/32/140043_2.png) [@Jayesh\_Auti](https://discuss.elastic.co/u/Jayesh_Auti)\ **Post date:** [February 5, 2026, 6:17am UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924/1 "2026-02-05T06:17:55Z")
Hi Guys, I am integrating SentinelOne with ELK, after adding console URL and API key it showing me to add elastic agent. Elastic agent is required for these type of integrations? Can anyone help me with this? ![Screenshot 2026-02-05 at 11.45.37 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1d51f60574c74dfa55597226217a43dad7458626.png) Thank you, Jayesh ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [February 5, 2026, 7:39am UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924/2 "2026-02-05T07:39:10Z")
Hello @Jayesh_Auti Welcome to the Community!! Yes, elastic agent will be required to collect the data. Similar post : > [@SentinelOne Integration](https://discuss.elastic.co/t/sentinelone-integration/310378/2): > > Hi @Medel - welcome to the Discuss community! Within Kibana, if you go to Management -\> Integrations, you should see the SentinelOne integration there. Once you go to that integration and click 'Add SentintelOne' it will take you to the integration configuration, where you can enter your S1 console URL and API key. You'll then need to assign the integration to an Elastic Agent to collect the events and ship to Elastic. For more information on Elastic Agent… Thanks!! ---
**Author:** ![Jayesh\_Auti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jayesh_auti/32/140043_2.png) [@Jayesh\_Auti](https://discuss.elastic.co/u/Jayesh_Auti)\ **Post date:** [February 5, 2026, 9:28am UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924/3 "2026-02-05T09:28:23Z")
Hi, Thank you for clarifying. I will be doing another integrations like AWS WAF, AWS Guard Duty, so for these also I will need seprate elastic agent or the same I can use and where I have to install the elastic agent on the same instance where ELK is hosted or somewhere else? Thank you, Jayesh ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [February 5, 2026, 10:07am UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924/4 "2026-02-05T10:07:42Z")
Hello @Jayesh_Auti To have 1 elastic-agent or multiple elastic-agent depends upon the type of data we need to collect & how it is available. For more information below documentation will help : > **[Fleet and Elastic Agent overview | Elastic Docs](https://www.elastic.co/docs/reference/fleet)** > > Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security... Thanks!! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 5, 2026, 1:22pm UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924/5 "2026-02-05T13:22:13Z")
> [@Jayesh\_Auti](#): > > I will be doing another integrations like AWS WAF, AWS Guard Duty, so for these also I will need seprate elastic agent or the same I can use and where I have to install the elastic agent on the same instance where ELK is hosted or somewhere else? You will need an Elastic Agent to run those integrations, it is recommended to no run anything else on Elasticsearch server, so it is better to use a different server. You can have a single policy for a single agent with those integration, but in some cases one single agent may not be enough to get the data for some sources. For example, AWS WAF can have a high volume rate in some cases and you would need multiple agents to consume it from the SQS + S3 configuration, but if you have an integration that uses API and run it on multiple agents, you will have duplicate data. So I would recommend to have a single policy for integrations where you get the data using some kind of API. And another policy and agent for integrations where you can consume the data with multiple agents without duplication, like all integrations that use SQS+S3 or Event Hub or Kafka as an input.