How to Export and Review SentinelOne Activity and Threat Logs
Summary
A practical guide to exporting SentinelOne activities and threats through its management API, following pagination, and reviewing audit events for suspicious changes. Endpoint telemetry is stored separately in Singularity Data Lake.
Key points
- Export threats and activities through the SentinelOne management API using an API token with view rights at the relevant account or site.
- The guide uses date filters and a cursor loop to retrieve records page by page; it notes that failing to follow the cursor can limit results to 1,000 records.
- Review activity records for agents being disabled or uninstalled, new exclusions, threats marked benign or resolved, policy changes, and unfamiliar console logins.
- The article suggests uploading exported files to LogTotal for sanitization and review at logtotal[.]com.
- Endpoint telemetry is not available through the management API; the article says it is stored in Singularity Data Lake.
- The troubleshooting section covers expired tokens, incorrect ApiToken headers, and tokens lacking the required site scope.
Article Details
- Defense Focus
- Export SentinelOne activity and threat records for audit and incident investigation, then review activity changes that could weaken endpoint protection or indicate suspicious console use.
- Detection Methods
- Review activity records for agents being uninstalled, disabled, or placed in a less protective mode.
- Investigate new exclusions, especially broad paths, and changes to policies.
- Check threats marked resolved or benign without investigation.
- Review console logins from unfamiliar locations, especially immediately before or during an incident.
- Data Sources
- SentinelOne management API activity records, which provide a console audit trail.
- SentinelOne management API threat records.
- Endpoint telemetry in Singularity Data Lake; the article says it is not available through the management API.
- Platforms
- SentinelOne management console and API
- LogTotal
- Defensive Actions
- Use an account or site-scoped user with view rights, generate an API token, and monitor its expiration.
- Export activity and threat records for the relevant time range, following the pagination cursor to retrieve all records.
- If results are empty, verify that the token has access to the intended site; if the API returns only 1,000 records, continue pagination.
- Sanitize exported data before reviewing it in LogTotal.
- Use Singularity Data Lake for endpoint telemetry; treat agent logs fetched for troubleshooting as diagnostic files, not security telemetry.
Vendors
Products
Deep VisibilityWhat about Deep Visibility?LogTotalBelow is how to get the data out, sanitize it, and investigate it for free in LogTotal.SentinelOneSentinelOne keeps three kinds of data worth exporting: endpoint telemetry, threats, and activities (the audit trail of what users and agents did in the console).Singularity Data LakeTelemetry lives in Singularity Data Lake and has its own guide.