SentinelOne Device Activated

Axonius supports SentinelOne Device Activated as an event in a Workflow.

Whenever a SentinelOne device is activated, SentinelOne triggers an event. All Workflows configured with this event are then triggered.

Configuring SentinelOne to Send Events to Axonius

Before including the SentinelOne Device Activated event in a Workflow the first time, you need to do the following:

• In the SentinelOne adapter, enable the Enable real-time asset updates (Supported events: Recently activated devices) option.
• Enable events in the SentinelOne adapter from System Settings or from the Event in the Workflow. The following screen shows enabling events from the System Settings> External Integrations> Workflows Events screen.
  

Adding the SentinelOne Device Activated Event to the Workflow

Add SentinelOne Device Activated as the triggering event of a Workflow or as an event anywhere else in the Workflow, where relevant. When this event occurs, the Workflow begins or continues running.

To select the SentinelOne Device Activated event as the Workflow trigger

1. In the Trigger Type pane, under User Onboarded or Offboarded, click the SentinelOne Device Activated tile. The SentinelOne Device Activated configuration opens in the Trigger Type pane.
2. If events are not enabled in the adapter, click View Webhook Configuration, select the Enable events in adapter checkbox, and click Apply. The screen in the next step appears.
3. If events are enabled in the adapter, the following screen appears.
   

The Workflow is triggered each time a SentinelOne device is activated. The next node runs on the retrieved device.

To select SentinelOne Device Activated as a non-triggering event

1. In the Event pane, under User Onboarded or Offboarded, click the SentinelOne Device Activated tile. The SentinelOne Device Activated configuration opens in the Event pane.
2. If events are not enabled in the adapter, click View Webhook Configuration, select the Enable events in adapter checkbox, and click Apply. The screen in the next step appears.
3. If events are enabled in the adapter, the following screen appears:
   

In this case, when a SentinelOne device is activated on the asset retrieved from the previous node, an event occurs and the Workflow continues running.