Security
SentinelOne integration
Reads which SentinelOne agents are turned off or not checking in. View-only.
Setup steps are for connected customers — sign in to read them.
What we find in SentinelOne
Agents that are disabled or disconnected, from SentinelOne's own reported health — an overlay on the RMM's fleet, not a second one. NOT "coverage vs RMM device count": that would be a cross-source join the pull architecture deliberately does not do (one credential, one pull), the same correction Defender needed.
Every finding lands on your Client Upsell board as a named client with a number beside it — not a report you have to read.
What the SentinelOne connection does
Read — powers Client Upsell
Read your clients' stack
Who is actually protected: endpoints still onboarding, seats never deployed, sites with no filtering policy.
Read-only
We only ever read — we never change anything in SentinelOne
You make a view-only key using our setup steps. Our connection has no code that can write to SentinelOne, and your key is encrypted and only used to read.
SentinelOne integration — common questions
- What does the SentinelOne integration read?
- Reads which SentinelOne agents are turned off or not checking in. View-only.
- What does MSProspector find in SentinelOne?
- Agents that are disabled or disconnected, from SentinelOne's own reported health — an overlay on the RMM's fleet, not a second one. NOT "coverage vs RMM device count": that would be a cross-source join the pull architecture deliberately does not do (one credential, one pull), the same correction Defender needed.
- Is the SentinelOne connection read-only?
- Yes. We only ever read from SentinelOne — our SentinelOne connection has no code that can change anything, and an automated check on every change to our code blocks any that could. Please create a view-only key using the setup steps, so the key itself can't make changes either.