SentinelOne

Overview

SentinelOne is an EDR/XDR platform. The Bumblebee integration is read-only and built for reporting: it surfaces endpoint coverage and agent health, threats detected and mitigated, analyst response activity, and — where your licence covers it — vulnerability findings and endpoints discovered with no agent installed.

It is sized for the security incidents & response section of a quarterly business review, so it aggregates rather than dumps: threat breakdowns are computed by SentinelOne server-side and returned as counts, not thousands of records.

Bumblebee never quarantines a device, runs a script, or changes a policy through this integration. Every tool is a read.

Prerequisites & Setup

You need:

Access to your SentinelOne management console
Permission to create an API token (a Service User is recommended)
Your console URL — SentinelOne gives every customer their own hostname

Find your management console URL

Sign in to SentinelOne and copy the origin from your browser's address bar — everything up to and including .sentinelone.net, with no trailing path.

It looks like https://usea1-partners.sentinelone.net or https://euce1-012.sentinelone.net; the region prefix depends on where your tenant is hosted.

Generate an API token

Recommended — a Service User token. It is not tied to a person and is scoped to the roles you grant:

Go to Settings → Users → Service Users
Click Actions → Create New Service User
Name it (e.g. "Bumblebee Reporting"), set an expiration, and grant a Viewer role over the scope you want reported — the whole account, or specific sites
Copy the token from the confirmation screen — it is shown once

Alternative — a personal API token. Settings → Users → My User → API Token → Generate. These typically expire after six months and stop working if the person leaves the organisation, so prefer a Service User for scheduled reporting.

A read-only role is sufficient. The integration performs no write operations.

Configure in Bumblebee

Go to the Integrations page in Bumblebee
Select SentinelOne
Enter your Management Console URL and API Token
Save

Sites are your clients

SentinelOne nests Account → Site → Group. On an MSP console, one Site is normally one end client, and carries its own licence seats, expiry, and module entitlement.

Ask for a report by client name and the agent resolves it to a site before pulling anything else. If you ask without naming a client, figures cover the entire console — every client at once.

What your licence covers

Some reporting sections require separately licensed SentinelOne modules.

Available on every SentinelOne SKU:

Section	What you get
Sites & accounts	Client scope, licence seats, expiry, entitlement
Endpoint coverage	Agents deployed, active, infected, out-of-date, by OS and machine type
Threats	Detected, mitigated, resolved; breakdowns by classification, verdict and status
Activity	Analyst actions, mitigations, config changes — the audit trail

Requires a paid module:

Section	Module
Vulnerabilities (CVEs) and software inventory	Application Risk / Vulnerability Management
Network discovery and unprotected endpoints	Ranger

You do not configure your SKU anywhere. Bumblebee detects entitlement at report time from the site record. If your tenant is not licensed for a module, that section is reported as not available — never as zero findings — and the rest of the report is unaffected. A tenant on Core gets a complete report with those two sections marked; a tenant on Complete gets everything.

A section marked "not available" means Bumblebee could not see the data, not that there is nothing to see. It is never rendered as a zero — reporting "0 vulnerabilities" for a customer who simply has no Vulnerability Management licence would be wrong.

Available Tools

Scope and licensing

Tool	Description
`list_sites`	Sites (normally one per client) with licence seats, expiry and module entitlement. The starting point for any client-scoped report.
`list_accounts`	Accounts on the console, with licence totals and expiry
`list_groups`	Groups within a site — e.g. servers vs workstations

Endpoint coverage

Tool	Description
`list_agents`	Deployed agents with health: active, infected, out-of-date, by OS, machine type and agent version

Threats and response

Tool	Description
`list_threats`	Threats in a window, filterable by classification, mitigation status, analyst verdict and incident status. Breakdowns are computed server-side.
`get_threat_timeline`	The full event timeline for one threat — for narrating a notable incident end to end
`list_activities`	Console activity: mitigations, analyst decisions, policy changes, logins
`list_activity_types`	The activity type IDs this console uses, for filtering activity

Exposure (requires a paid module)

Tool	Description
`list_application_risks`	CVE findings by severity, risk score, and known in-the-wild exploitation
`list_application_risk_endpoints`	Which endpoints carry a given vulnerable application
`list_application_inventory`	Installed software across the estate, by application and vendor
`list_network_discovery_devices`	Devices Ranger has seen on the network, managed or not
`list_unprotected_endpoints`	Devices on the network with no SentinelOne agent

Reporting

Tool	Description
`get_qbr_summary`	Every reporting figure for a client in one call — licences, coverage, threats, vulnerabilities, unprotected endpoints. Degrades by licence.

Example prompts

"Give me a SentinelOne QBR summary for Contoso for last quarter"
"How many endpoints does Contoso have protected, and how many are out of date?"
"Break down Contoso's threats last quarter by classification"
"Which Contoso machines have no SentinelOne agent installed?"
"Show me the timeline for the ransomware detection on Contoso's file server"
"What critical CVEs are being exploited in the wild across Contoso's estate?"

Reporting notes

Worth knowing when reading a Bumblebee report built on SentinelOne:

Threat counts exclude custom STAR rule alerts. They come from SentinelOne's detection engine. If you rely heavily on custom STAR rules, expect the figure to read lower than the console view showing both.
Response time is derived, not reported. SentinelOne exposes no mean-time-to-respond field. Bumblebee derives it from when a threat was identified against when it was mitigated in the activity trail. Auto-mitigated threats are reported separately — their response time is effectively zero and would otherwise flatter the average.
Licence seats are not deployed agents. activeLicenses on a site and the agent count answer different questions. Both are reported; the gap between them is the utilisation story.

Troubleshooting

Every request fails with an authentication error. Check the console URL is an origin with no trailing path, and that the token has not expired — personal API tokens typically last six months.

A report section says "not available". Your tenant is either not licensed for that module, or the token's role cannot read it. Check the site's licensed modules in SentinelOne; if the module is listed, widen the token's role.

Figures cover more clients than expected. Name the client in your prompt. Without a client, the tools report across the whole console.

SentinelOne

On this page