Add SentinelOne as a posture provider

Firezone syncs SentinelOne agent inventory to evaluate endpoint health, infection status, firewall state, and recent activity. SentinelOne posture fields apply to Windows, macOS, and Linux, with narrower support for some checks.

Before you begin

Complete the shared prerequisites. You need access to administer your SentinelOne Management Console, an endpoint with a reporting agent, and a dedicated service user that can view endpoints.

The connection requires a management URL under *.sentinelone.net and an API token authorized to call GET /web/api/v2.1/agents. Include the accounts or sites containing the endpoints whose posture Firezone should evaluate in the service user's access scope.

Prepare the API token

1. In the SentinelOne Management Console, create or select a dedicated service user for Firezone.
2. Assign read access to endpoint inventory for the required accounts or sites. Use your console's API documentation to confirm access to GET /web/api/v2.1/agents.
3. Generate an API token for that service user and record its expiry so you can replace it before it stops working.
4. Copy the management console origin, such as https://acme.sentinelone.net, for the Firezone connection.

Firezone reads agent inventory and does not require endpoint remediation or other write permissions. Use the service-user and API-token controls documented in your SentinelOne console for your console version.

Add the provider

1. In Firezone, open Settings → Device Posture → Add posture provider and select SentinelOne.
2. Enter a Name and the Management URL.
3. Paste the token into API Token. Enter the token itself without the ApiToken authorization prefix.
4. Select Verify Now. After Verified appears, select Create.
5. Request Sync Now from the provider's actions menu and wait for Last Synced to update.
6. Open your test device's Posture tab and confirm its SentinelOne record appears with the expected serial number and agent state.

Firezone matches SentinelOne agents by hardware serial. Use Device Trust to attest that serial and enable Require attestation on the Policy. A matching hostname or agent UUID alone does not associate a SentinelOne record with a Firezone Client.

Use SentinelOne evidence in Policies

Follow the Policy setup steps to select the simplified checks you need.

The No active threats check uses the infection flag. For an explicit requirement that every matched SentinelOne record report zero active threats, use the JSON tab.

{
  "field": "sentinelone.active_threats",
  "op": "eq",
  "value": 0,
  "rows": "all"
}

Missing threat counts fail this comparison. See the SentinelOne attribute reference for agent versions, network state, tags, scan results, and other fields.

Troubleshooting

If verification fails, check the management origin and whether the token is expired, revoked, or lacks permission to list agents. Firezone accepts HTTPS SentinelOne management origins ending in .sentinelone.net.

If the device count is lower than expected, check the service user's account and site scope. A token that sees one site can verify successfully while omitting devices in another site.

If an agent syncs but does not match a Client, inspect its reported serial and compare it with the Firezone device identity. Missing or different serials prevent a match even when the agent is otherwise healthy.

If a check fails, inspect the agent's actual activity, decommissioning, infection, or firewall values in the Posture tab. Resolve the state in SentinelOne, let the agent report it, and request Sync Now in Firezone.

To rotate the token, edit the provider, paste the replacement, select Verify Now, and Save. Confirm that inventory sync succeeds before revoking the previous token.

Need help? See all support options.