┌─────────────────────────────────────────────────────────────────────┐
│               SentinelOne Enterprise Deployment                     │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  ┌────────────────┐                                                │
│  │  SentinelOne   │                                                │
│  │   Management   │◀────────────────────────────────────────┐      │
│  │    Console     │                                         │      │
│  └───────┬────────┘                                         │      │
│          │                                                  │      │
│          │                                                  │      │
│          ▼                                                  │      │
│  ┌────────────────────────────────────────────────────────────────┐│
│  │                    Endpoint Protection                          ││
│  │  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐           ││
│  │  │   Windows    │ │    macOS     │ │    Linux     │           ││
│  │  │  Endpoints   │ │  Endpoints   │ │   Servers    │           ││
│  │  │   (500+)     │ │    (100+)    │ │    (50+)     │           ││
│  │  └──────────────┘ └──────────────┘ └──────────────┘           ││
│  └────────────────────────────────────────────────────────────────┘│
│                                                                     │
│  ┌────────────────────────────────────────────────────────────────┐│
│  │                    Security Operations                          ││
│  │  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐           ││
│  │  │   Threat     │ │   Response   │ │   Threat     │           ││
│  │  │  Detection   │ │  Playbooks   │ │   Hunting    │           ││
│  │  └──────────────┘ └──────────────┘ └──────────────┘           ││
│  └────────────────────────────────────────────────────────────────┘│
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

Account: Company Name
├── Site: North America
│   ├── Group: Workstations
│   ├── Group: Servers
│   └── Group: Executives
├── Site: Europe
│   ├── Group: Workstations
│   └── Group: Servers
└── Site: Development
    └── Group: Dev-Workstations

Policy Name: Server-Protection-Policy
Settings:
  Agent Mode: Protect
  Remediation: Auto-Remediate
  Rollback: Enabled
  Performance Focus: Balanced
  Scan Intensity: Low (reduce server impact)
  Deep Visibility: Enabled
  Network Quarantine: Manual (prevent accidental isolation)

Policy Name: Executive-HighSecurity-Policy
Settings:
  Agent Mode: Protect
  USB Control: Block Unknown
  Bluetooth: Monitor
  Anti-Tampering: Maximum
  Network Quarantine: Enabled
  Firewall: Strict Profile

# Export exclusions to CSV for documentation
$s1mgmt = "https://usea1-xxx.sentinelone.net"
$apiToken = "<API-Token>"
 
$headers = @{
    "Authorization" = "APIToken $apiToken"
    "Content-Type" = "application/json"
}
 
$exclusions = Invoke-RestMethod -Uri "$s1mgmt/web/api/v2.1/exclusions" -Headers $headers -Method Get
 
$exclusions.data | Select-Object type, value, description, osType |
    Export-Csv ".\sentinelone-exclusions.csv" -NoTypeInformation

:: deploy-sentinelone.bat
@echo off
 
SET INSTALLER_PATH=\\fileserver\software\SentinelOne\
SET SITE_TOKEN=<your-site-token>
SET LOG_PATH=C:\Windows\Temp\S1Install.log
 
:: Check if already installed
sc query SentinelAgent >nul 2>&1
IF %ERRORLEVEL% EQU 0 (
    echo SentinelOne already installed. Exiting.
    exit /b 0
)
 
:: Install SentinelOne
msiexec /i "%INSTALLER_PATH%SentinelOneInstaller.msi" SITE_TOKEN=%SITE_TOKEN% /qn /l*v %LOG_PATH%
 
IF %ERRORLEVEL% EQU 0 (
    echo Installation successful
) ELSE (
    echo Installation failed with error %ERRORLEVEL%
)

# SCCM Application Detection Script
$S1Service = Get-Service -Name "SentinelAgent" -ErrorAction SilentlyContinue
$MinVersion = [Version]"23.4.1.0"
 
if ($S1Service) {
    $AgentPath = "C:\Program Files\SentinelOne\Sentinel Agent*\SentinelAgent.exe"
    $AgentFile = Get-Item $AgentPath -ErrorAction SilentlyContinue
    if ($AgentFile) {
        $CurrentVersion = [Version]$AgentFile.VersionInfo.FileVersion
        if ($CurrentVersion -ge $MinVersion) {
            Write-Host "Installed"
            exit 0
        }
    }
}
exit 1

SentinelOneInstaller_windows.exe -t "<SITE_TOKEN>" -q

"C:\Program Files\SentinelOne\Sentinel Agent <version>\Uninstall.exe" /uninstall /q /passphrase="<PASSPHRASE>"

#!/bin/bash
SITE_TOKEN="<your-site-token>"
INSTALLER_PATH="/tmp/SentinelOne.pkg"
 
# Download installer (or copy from MDM)
# curl -o $INSTALLER_PATH "https://..."
 
# Install with token
sudo installer -pkg $INSTALLER_PATH -target /
 
# Register with site token
sudo /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentinelctl set registration-token $SITE_TOKEN
 
# Start agent
sudo /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentinelctl control start

#!/bin/bash
SITE_TOKEN="<your-site-token>"
 
# Install dependencies
yum install -y libc.so.6
 
# Install agent
rpm -i SentinelAgent_linux.rpm
 
# Register
/opt/sentinelone/bin/sentinelctl management token set "$SITE_TOKEN"
 
# Start
/opt/sentinelone/bin/sentinelctl control start

#!/bin/bash
SITE_TOKEN="<your-site-token>"
 
# Install
dpkg -i SentinelAgent_linux.deb
 
# Register and start
/opt/sentinelone/bin/sentinelctl management token set "$SITE_TOKEN"
/opt/sentinelone/bin/sentinelctl control start

$headers = @{
    "Authorization" = "APIToken $apiToken"
    "Content-Type" = "application/json"
}
 
# Get all agents
$agents = Invoke-RestMethod -Uri "$s1mgmt/web/api/v2.1/agents" -Headers $headers -Method Get
 
# Summary report
$agents.data | Group-Object -Property osType | Select-Object Name, Count
 
# Find agents with issues
$agents.data | Where-Object { $_.isActive -eq $false -or $_.isUpToDate -eq $false } |
    Select-Object computerName, osType, isActive, isUpToDate, lastActiveDate |
    Export-Csv ".\agents-issues.csv" -NoTypeInformation

# Generate EICAR test file (will be detected and quarantined)
$eicar = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
$eicar | Out-File -FilePath "C:\Test\eicar.txt" -Encoding ascii

EventType = "Process Creation" AND
TgtProcCmdLine ContainsCIS "-enc" OR
TgtProcCmdLine ContainsCIS "encodedcommand" OR
TgtProcCmdLine ContainsCIS "bypass" AND
TgtProcName = "powershell.exe"

EventType = "Open Remote Process Handle" AND
TgtProcName = "lsass.exe" AND
SrcProcName != "csrss.exe" AND
SrcProcName != "services.exe"

EventType = "IP Connect" AND
DstPort In (4444, 5555, 6666, 1337, 8080) AND
SrcProcName != "svchost.exe"

EventType = "Process Creation" AND
(TgtProcName = "psexec.exe" OR
 TgtProcName = "wmic.exe" OR
 TgtProcName = "winrs.exe") AND
SrcProcCmdLine ContainsCIS "\\"

EventType = "Registry Value Modified" AND
RegistryPath ContainsCIS "CurrentVersion\Run"

Rule Name: Mimikatz Execution
Query: TgtProcCmdLine ContainsCIS "sekurlsa" OR TgtProcCmdLine ContainsCIS "logonpasswords" OR TgtProcCmdLine ContainsCIS "mimikatz"
Severity: Critical
Action: Alert + Network Quarantine

Rule Name: Cobalt Strike Indicators
Query: |
  (SrcProcCmdLine ContainsCIS "beacon" AND EventType = "DNS Lookup") OR
  (DstPort = 50050 AND EventType = "IP Connect") OR
  (TgtFilePath ContainsCIS "cobaltstrike")
Severity: Critical
Action: Alert + Quarantine + Network Isolate

# response_automation.py
import requests
import json
 
class SentinelOneResponse:
    def __init__(self, base_url, api_token):
        self.base_url = base_url
        self.headers = {
            "Authorization": f"APIToken {api_token}",
            "Content-Type": "application/json"
        }
 
    def network_quarantine(self, agent_id):
        """Isolate endpoint from network."""
        endpoint = f"{self.base_url}/web/api/v2.1/agents/{agent_id}/actions/network-quarantine"
        response = requests.post(endpoint, headers=self.headers)
        return response.json()
 
    def fetch_logs(self, agent_id):
        """Fetch agent logs for investigation."""
        endpoint = f"{self.base_url}/web/api/v2.1/agents/{agent_id}/actions/fetch-logs"
        response = requests.post(endpoint, headers=self.headers)
        return response.json()
 
    def full_disk_scan(self, agent_id):
        """Initiate full disk scan."""
        endpoint = f"{self.base_url}/web/api/v2.1/agents/{agent_id}/actions/scan"
        payload = {"data": {"scanType": "full"}}
        response = requests.post(endpoint, headers=self.headers, json=payload)
        return response.json()
 
    def kill_process(self, agent_id, process_name):
        """Kill suspicious process."""
        endpoint = f"{self.base_url}/web/api/v2.1/agents/{agent_id}/actions/kill-process"
        payload = {"data": {"processName": process_name}}
        response = requests.post(endpoint, headers=self.headers, json=payload)
        return response.json()
 
    def remediate_threat(self, threat_id):
        """Remediate detected threat."""
        endpoint = f"{self.base_url}/web/api/v2.1/threats/{threat_id}/actions/mitigate"
        payload = {"data": {"action": "remediate"}}
        response = requests.post(endpoint, headers=self.headers, json=payload)
        return response.json()
 
# Example usage
s1 = SentinelOneResponse("https://usea1-xxx.sentinelone.net", "<token>")
s1.network_quarantine("agent-uuid-here")

{
  "event": "threat",
  "threatInfo": {
    "id": "123456",
    "threatName": "Ransomware.Generic",
    "classification": "Malware",
    "agentId": "agent-uuid",
    "computerName": "DESKTOP-ABC123",
    "siteName": "North America"
  },
  "timestamp": "2026-02-03T14:30:00Z"
}

$headers = @{
    "Authorization" = "APIToken $apiToken"
    "Content-Type" = "application/json"
}
 
# Get threats from last 30 days
$thirtyDaysAgo = (Get-Date).AddDays(-30).ToString("yyyy-MM-ddT00:00:00Z")
$threats = Invoke-RestMethod -Uri "$s1mgmt/web/api/v2.1/threats?createdAt__gte=$thirtyDaysAgo" -Headers $headers
 
# Summary
$summary = @{
    TotalThreats = $threats.data.Count
    Mitigated = ($threats.data | Where-Object { $_.mitigationStatus -eq "mitigated" }).Count
    ByClassification = $threats.data | Group-Object classification | Select-Object Name, Count
    TopAffectedMachines = $threats.data | Group-Object computerName | Sort-Object Count -Descending | Select-Object -First 5
}
 
$summary | ConvertTo-Json -Depth 3