How to connect SentinelOne EDR to HOPLONai (API token setup)

Create a SentinelOne service user API token and find your base URL to connect SentinelOne to HOPLONai. Viewer role recommended; tokens last up to 2 years.

To connect SentinelOne to HOPLONai, create a service user with the Viewer role, generate an API token valid for one to two years, and share the token and your console base URL with the HOPLONai integration team.

HOPLONai gives growing businesses a complete security operation: the tools, and the agentic AI team that operates them.

Complete these steps before your scheduled onboarding session.

What do you need before you start?

  • A SentinelOne subscription: Endpoint Security Complete SKU with the Remote Script Orchestration add-on.

  • Admin access to the SentinelOne console.

You will hand over two things: an API token (service user recommended) and your base URL.

How do you create a SentinelOne API token for HOPLONai?

Use a service user. Its token can last up to two years, so you renew it far less often.

  1. Open Service Users. Log in to the SentinelOne admin console and go to {base_url}/settings/users/service-users.

  2. Create the service user. Click Actions > Create New Service User and enter:

    • Name: hoplonai-api (or another descriptive name)

    • Description: Retrieve logs for HOPLONai integration

    • Duration: 1y or 2y

  3. Set the scope of access. Choose the Viewer role: it is read-only and gives the minimum permissions. Choose Admin only if you want HOPLONai email address enrichment, which tags each endpoint to its user's email address for better device tracking.

  4. Copy the token. Copy it immediately and store it securely: SentinelOne will not show it again.

Can you use a personal user API token instead?

You can, but it is not recommended: user tokens expire after 30 days and need monthly renewal. In the console go to My User > Actions > API Token Operations > Generate API Token, copy the user token, then generate an authentication token from it.

How do you find your SentinelOne base URL?

Log in to SentinelOne and copy the address from your browser bar. That is your base URL, for example https://your-company.sentinelone.net or https://usea1-partners.sentinelone.net.

Are you ready for onboarding?

  • Service user created in SentinelOne

  • API token generated with a 1 to 2 year expiry

  • Viewer role assigned (or Admin for email enrichment)

  • Token stored securely

  • Base URL recorded

  • Token and base URL shared with the HOPLONai integration team

How should you protect the API token?

  • Keep it in a password manager or secrets vault.

  • Never send it over an unencrypted channel.

  • Limit access to authorised people.

  • Rotate it before it expires, set a reminder 30 days ahead, and update the token in HOPLONai when you do.

Quick reference

Item

Value

Service user name

hoplonai-api

Token duration

1 to 2 years

Recommended role

Viewer

Base URL format

https://your-instance.sentinelone.net

Renewal reminder

30 days before expiry

Frequently asked questions

Is the Viewer role enough for HOPLONai?

Yes, for log retrieval. You need Admin only for email address enrichment.

Which other EDRs does HOPLONai integrate with?

Live integrations include CrowdStrike, SentinelOne, Bitdefender, Trend Micro and Trellix, and the list keeps growing. See what you need before onboarding Endpoint Security (EDR).

Who do I contact if something goes wrong?

For SentinelOne console issues, your SentinelOne administrator or SentinelOne support. For integration questions, the HOPLONai integration team.

HOPLONai is agentic MDR โ€” the security tools a growing business needs, and the AI team that runs them.

See how HOPLONai runs your EDR: book a platform tour at hoplonai.com.

Document version 1.1 ยท Last updated October 2026

Did this answer your question?
๐Ÿ˜ž
๐Ÿ˜
๐Ÿ˜