SentinelOne Singularity Operations Center

LAST UPDATED: NOVEMBER 27, 2025

Overview

SentinelOne Singularity is an enterprise cybersecurity platform offering unified prevention, detection, and response across the security estate. It simplifies endpoint, cloud, and identity protection through one centralized, autonomous platform, making machine-speed decisions with static and behavioral AI. With AI SIEM, Singularity also ingests and analyzes massive security data in real time to deliver advanced threat detection and faster investigations.

D3 SOAR is providing REST operations to function with SentinelOne Singularity Operations Center.

SentinelOne Singularity Operations Center is available for use in:

Known Limitations

The SentinelOne Singularity Operations Center API enforces a rate limit of 25 requests per second for each API token across all commands in this integration.

Refer to API rate limits for details.

Connection

Gather the following information to connect D3 SOAR to SentinelOne Singularity Operations Center.

READER NOTE

The Singularity™ Operations Center must be enabled to use this integration. Refer to How to opt in to the Singularity Operations Center for more information.

Permission Requirements

Each endpoint in the SentinelOne Singularity Operations Center API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command	Required Permissions
Fetch Event	Unified Alerts with View access enabled for all alert types: STAR Alerts Mobile Alerts Identity Alerts Generic Alerts Endpoint Alerts READER NOTE The Unified Alerts > View permission is automatically selected when View permission is enabled for any alert type.
Test Connection

As SentinelOne Singularity Operations Center is using role-based access control (RBAC), the API Token is generated based on a specific user account and the application. Therefore, the command permissions are inherited from the user account’s role. Users need to configure their user profile from the SentinelOne Singularity Operations Center console for each command in this integration.

Configuring SentinelOne Singularity Operations Center to Work with D3 SOAR

This section demonstrates how to:

• Configure a role with the required permissions

• Create a service user for API use

• Assign the role to the service user

• Generate an API token

For information on generating an API token for an existing console user, refer to this resource after authenticating.

1. Log into the SentinelOne Singularity Operations Center console with administrator privileges.

   

2. Navigate to Policy & Settings > Roles, then click the New Role button.

   

3. Configure the new role.

   

   1. Enter a role name.

   2. Search for and select the relevant permission category.

   3. Enable the required permissions.

   4. Click the Save button.

4. Select the Service Users tab, then click the New Service User button.

   

5. Configure the service user.

   

   1. Enter a name.

   2. Select the sites to access.

   3. Search for and select the newly created role.

   4. Click the Create Service User button.

6. Copy the displayed API token and store it securely.

   

   Refer to step 3.i.2 in Configuring D3 SOAR to Work with SentinelOne Singularity Operations Center.

Configuring D3 SOAR to Work with SentinelOne Singularity Operations Center

1. Log in to D3 SOAR.

2. Find the SentinelOne Singularity Operations Center integration.

   

   1. Navigate to Configuration on the top header menu.

   2. Click on the Integration icon on the left sidebar.

   3. Type SentinelOne Singularity Operations Center in the search box to find the integration, then click it to select it.

   4. Click on the + Connection button on the right side of the Connections section. A new connection window will appear.

3. Configure the following fields to create a connection to SentinelOne Singularity Operations Center.

   

   1. Connection Name: The desired name for the connection.

   2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

   3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

   4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

   5. Description (Optional): The description for the connection.

   6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

      

   7. Configure User Permissions: Defines which users have access to the connection.

   8. Active: The checkbox that enables the connection to be used when selected.

   9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

      

      1. Input the Server URL.

      2. Input the API Token from the SentinelOne Singularity Operations Center platform. Refer to step 6 in Configuring SentinelOne Singularity Operations Center to Work with D3 SOAR.

      3. Input the API Version. The default value is v2.1.

   10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

   11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.

4. Test the connection.

   

   1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

   2. Click OK to close the alert window.

   3. Click + Add to create and add the configured connection.

Commands

SentinelOne Singularity Operations Center includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the SentinelOne Singularity Operations Center API, refer to the SentinelOne Singularity Operations Center API reference. Users must authenticate to access the webpage.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring SentinelOne Singularity Operations Center to Work with D3 SOAR sections for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

1. Navigate to Configuration Application Settings. Select Date/Time Format.

   

2. Choose the desired date and time format, then click on the Save button.

   

The selected time format will now be visible when configuring Date/Time command input parameters.

Fetch Event

Ingests Singularity unified alerts into the vSOC platform as D3 events. The returned unified alerts are sorted by the specified Time Field in descending order.

Input

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

See Field Mappings.

The SentinelOne Singularity Operations Center system integration includes pre-configured field mappings for the default event source.

The Default Event Source is the default system-provided set of field mappings applied when the fetch event command is executed. It includes a Main Event JSON Path, which is the JSONPath expression that points to the base array of event objects. The source field path continues from this array to locate the required data.

The Main Event JSON Path can be viewed by clicking on the Edit Event Source button.

• Main Event JSON Path: $.data.alerts.edges
  The data.alerts.edges array contains the event objects. Within each object, the key node.id denotes the Document ID field. As such, the full JSONPath expression to extract the Document ID is $.data.alerts.edges.node.id.

The pre-configured field mappings are detailed below:

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.