The ServiceNow-SentinelOne integration connects enterprise endpoint security monitoring with IT service management, enabling automated incident creation from threat detections, orchestrated endpoint quarantine workflows, and real-time CMDB enrichment with security posture data. This integration is primarily used by Security Operations Centers (SOCs), IT Operations teams, and Incident Response teams who need to bridge security alerts with structured service management processes. The integration supports bi-directional data flows where SentinelOne pushes threat detections and endpoint status to ServiceNow security incidents and CMDB records, while ServiceNow can trigger quarantine actions and policy updates back to SentinelOne endpoints. Primary automation patterns include webhook-triggered incident creation and Flow Designer orchestrations, implemented through the Security Operations module and Integration Hub.
Prerequisites
- •ServiceNow Utah or later with Security Operations plugin (com.snc.security_incident) activated
- •Integration Hub Professional license or higher for advanced orchestration workflows
- •SentinelOne Management Console with API access enabled and Admin or Service User role
- •MID Server configured if SentinelOne Management Console is deployed behind firewall
- •Security Incident Response plugin installed for advanced threat intelligence correlation
- •CMDB Health Dashboard plugin recommended for endpoint lifecycle management
- •Flow Designer admin role for creating automated quarantine workflows
Architecture Overview
The integration leverages ServiceNow's native REST capabilities and Flow Designer actions to communicate with SentinelOne's REST API v2.1, with no dedicated Integration Hub spoke available requiring custom REST Message configurations. Authentication is established using SentinelOne API tokens stored in ServiceNow Connection & Credential Aliases, with credentials encrypted in the sys_credential table and referenced through Connection Alias records for secure token management. Data flow is primarily uni-directional from SentinelOne to ServiceNow via webhook notifications for real-time threat detection, with bi-directional flows enabled through Flow Designer subflows that can trigger quarantine actions back to SentinelOne endpoints. A MID Server is required only when SentinelOne Management Console is deployed in private networks, as the integration relies on outbound HTTPS calls to SentinelOne's API endpoints on port 443. Rate limiting considerations include SentinelOne's default API limit of 100 requests per minute per tenant, requiring implementation of retry logic and request throttling in custom scripts.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation Steps
Generate SentinelOne API token and create ServiceNow credentials
In SentinelOne Management Console, navigate to Settings > Users and create a service account with 'Admin' or 'IR Team' role, then generate an API token from the user's profile settings. In ServiceNow, navigate to Connections & Credentials > Credentials and create a new Basic Auth credential record with username as the SentinelOne service account email and password as the generated API token. Set the credential name to 'SentinelOne_API_Credential' for consistency across integration components. Verify the credential is properly encrypted by checking that the password field shows asterisks after saving the record.
Configure Connection Alias and REST Message for SentinelOne API
Navigate to System Web Services > Outbound > Connection Alias and create a new connection alias named 'SentinelOne_Connection' pointing to your SentinelOne tenant URL (e.g., https://your-tenant.sentinelone.net). Set the credential to the previously created 'SentinelOne_API_Credential' and configure connection timeout to 30 seconds. Create a REST Message record under System Web Services > Outbound > REST Message named 'SentinelOne API' with endpoint URL referencing the connection alias. Add HTTP methods for common operations like 'Get Threats', 'Get Agents', and 'Quarantine Agent' with appropriate SentinelOne API paths.
// REST Message HTTP Method configuration for Get Threats
// Endpoint: ${conn_alias.SentinelOne_Connection}/web/api/v2.1/threats
// HTTP Method: GET
// HTTP Headers: Authorization: Bearer ${credential.SentinelOne_API_Credential.password}
var request = new sn_ws.RESTMessageV2('SentinelOne API', 'Get Threats');
request.setStringParameterNoEscape('limit', '1000');
request.setStringParameterNoEscape('resolved', 'false');
var response = request.execute();
gs.info('SentinelOne API Response: ' + response.getBody());Create inbound webhook endpoint for SentinelOne notifications
Navigate to System Web Services > Scripted REST APIs and create a new API named 'SentinelOne Webhook' with namespace 'sentinelone' and base API path '/webhooks'. Create a resource named 'threat_detection' with relative path '/threat' and HTTP method POST to receive threat notifications from SentinelOne. Configure the script to parse incoming webhook payload and extract threat details like classification type, threat name, affected endpoint, and confidence level. Implement webhook authentication by validating a shared secret in the request headers or payload to ensure requests originate from your SentinelOne tenant.
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
try {
var payload = JSON.parse(request.body.dataString);
var threatData = payload.data;
// Validate webhook secret
if (request.headers['x-sentinel-signature'] != gs.getProperty('sentinelone.webhook.secret')) {
response.setStatus(403);
return;
}
// Create security incident from threat
var incident = new GlideRecord('sn_si_incident');
incident.initialize();
incident.short_description = 'SentinelOne Threat Detected: ' + threatData.classification;
incident.description = 'Threat ID: ' + threatData.id + '\nAgent: ' + threatData.agentComputerName;
incident.severity = threatData.confidenceLevel > 80 ? 1 : 2;
incident.state = 1; // New
incident.insert();
response.setStatus(200);
} catch (e) {
gs.error('SentinelOne webhook error: ' + e.message);
response.setStatus(500);
}
})(request, response);Configure SentinelOne webhook subscription in Management Console
In SentinelOne Management Console, navigate to Settings > Integrations > Webhooks and create a new webhook subscription for threat-related events. Set the webhook URL to your ServiceNow instance webhook endpoint (e.g., https://instance.servicenow.com/api/sentinelone/webhooks/threat) and configure authentication headers including any shared secrets. Select event types to monitor including 'threats.detected', 'threats.resolved', and 'agent.status.changed' based on your incident management requirements. Test the webhook configuration using SentinelOne's built-in test feature to verify ServiceNow receives and processes the webhook payload correctly.
Create Flow Designer workflow for automated endpoint quarantine
Navigate to Process Automation > Flow Designer and create a new flow named 'SentinelOne Automated Quarantine' triggered by Security Incident table updates where severity is Critical and state changes to 'In Progress'. Add a REST step using your SentinelOne REST Message to call the quarantine agent API endpoint with the affected endpoint's agent ID extracted from the incident description. Configure the flow to update the security incident with quarantine status and create a related Change Request for endpoint isolation tracking. Include error handling to catch API failures and create assignment notifications to security analysts when automatic quarantine fails.
// Flow Designer Script Step for agent quarantine
var agentId = fd_data.trigger.current.correlation_id; // Assuming agent ID stored in correlation_id
var request = new sn_ws.RESTMessageV2('SentinelOne API', 'Quarantine Agent');
request.setStringParameterNoEscape('ids', agentId);
request.setRequestHeader('Content-Type', 'application/json');
var response = request.execute();
if (response.getStatusCode() == 200) {
fd_data.quarantine_status = 'success';
fd_data.quarantine_response = response.getBody();
} else {
fd_data.quarantine_status = 'failed';
fd_data.error_message = response.getErrorMessage();
}
fd_dataImplement CMDB endpoint enrichment with SentinelOne agent data
Create a scheduled job under System Definition > Scheduled Jobs named 'SentinelOne CMDB Sync' that runs every 4 hours to synchronize endpoint data between SentinelOne agents and ServiceNow CMDB computer records. Configure the job to query SentinelOne's agents API endpoint and match agents to existing CMDB CIs using computer name, serial number, or MAC address as correlation keys. Update CMDB records with SentinelOne-specific attributes like agent version, last seen timestamp, threat protection status, and policy compliance state by adding custom fields to the Computer CI class. Implement delta synchronization logic to avoid processing unchanged records and maintain an audit trail of security posture changes in CI history.
// Scheduled Job Script for CMDB enrichment
var request = new sn_ws.RESTMessageV2('SentinelOne API', 'Get Agents');
var response = request.execute();
if (response.getStatusCode() == 200) {
var agents = JSON.parse(response.getBody()).data;
agents.forEach(function(agent) {
var computer = new GlideRecord('cmdb_ci_computer');
if (computer.get('name', agent.computerName)) {
computer.u_sentinelone_agent_id = agent.id;
computer.u_sentinelone_version = agent.agentVersion;
computer.u_last_seen = new GlideDateTime(agent.lastActiveDate);
computer.u_protection_status = agent.isActive ? 'Protected' : 'At Risk';
computer.u_policy_name = agent.groupName;
computer.update();
gs.info('Updated CMDB CI: ' + computer.name + ' with SentinelOne data');
}
});
}Configure security incident correlation and threat intelligence enrichment
Navigate to Security Operations > Administration > Data Inputs and create a new threat intelligence feed integration that correlates SentinelOne threat indicators with external threat intelligence sources through ServiceNow's Security Incident Response module. Configure correlation rules under Security Operations > Correlation Rules to automatically link related security incidents based on common indicators like file hashes, IP addresses, or attack patterns detected by SentinelOne. Set up automated playbooks that enrich security incidents with additional context from SentinelOne's threat analysis, including MITRE ATT&CK technique mappings, behavioral analysis results, and recommended remediation actions. Implement escalation rules that automatically assign critical threats to senior security analysts based on SentinelOne's confidence scoring and threat classification.
// Business Rule for threat intelligence correlation on Security Incident
var threatHash = current.u_threat_hash;
if (threatHash && current.state.changesFrom('1')) {
// Query SentinelOne for additional threat context
var request = new sn_ws.RESTMessageV2('SentinelOne API', 'Get Threat Details');
request.setStringParameterNoEscape('contentHash', threatHash);
var response = request.execute();
if (response.getStatusCode() == 200) {
var threatData = JSON.parse(response.getBody()).data;
current.u_mitre_tactics = threatData.mitreTactics.join(', ');
current.u_threat_classification = threatData.classification;
current.u_confidence_level = threatData.confidenceLevel;
current.work_notes = 'Enriched with SentinelOne threat intelligence: ' + threatData.description;
}
}Test integration workflows and validate security incident lifecycle
Perform end-to-end testing by triggering a controlled threat detection in SentinelOne test environment and verifying that ServiceNow receives webhook notifications, creates security incidents with appropriate priority and assignment, and executes automated response workflows. Test the quarantine functionality by manually triggering the Flow Designer workflow and confirming that SentinelOne agents receive quarantine commands and report status back to ServiceNow. Validate CMDB synchronization by comparing agent data between SentinelOne Management Console and ServiceNow computer records, ensuring field mappings are accurate and timestamps reflect recent synchronization. Create test scenarios for common failure modes like network connectivity issues, authentication failures, and API rate limiting to verify error handling and recovery mechanisms work correctly.
// Test Script for integration validation
var testIncident = new GlideRecord('sn_si_incident');
testIncident.initialize();
testIncident.short_description = 'SentinelOne Integration Test';
testIncident.u_sentinelone_agent_id = 'test-agent-123';
testIncident.severity = 1;
testIncident.state = 2; // In Progress
var incidentId = testIncident.insert();
// Validate webhook endpoint
var testPayload = {
'data': {
'id': 'threat-test-456',
'classification': 'Malware',
'agentComputerName': 'TEST-ENDPOINT-01',
'confidenceLevel': 95
}
};
gs.info('Test incident created: ' + incidentId);
gs.info('Webhook test payload: ' + JSON.stringify(testPayload));Common Use Cases
Real-time malware detection incident creation
When SentinelOne detects malware on an endpoint, it immediately sends a webhook notification to ServiceNow that automatically creates a high-priority security incident with detailed threat information including file hashes, attack vectors, and affected systems. The incident is automatically assigned to the appropriate security team based on threat classification and severity scoring from SentinelOne's behavioral analysis engine. This automation eliminates manual alert triage and ensures consistent incident response procedures while maintaining full audit trails for compliance reporting.
Automated endpoint quarantine during active attacks
Critical security incidents trigger Flow Designer workflows that automatically quarantine affected endpoints through SentinelOne's isolation API, preventing lateral movement during active attacks. The workflow simultaneously creates emergency change requests for network isolation, notifies affected users and their managers about system unavailability, and schedules automated remediation tasks based on threat type. ServiceNow tracks quarantine duration, monitors endpoint status through continuous API polling, and automatically initiates recovery procedures once threats are resolved and validated clean.
CMDB security posture tracking and compliance reporting
Scheduled synchronization jobs enrich CMDB computer records with real-time security data from SentinelOne agents, including protection status, policy compliance, threat exposure history, and agent health metrics. This integration enables security dashboard reporting that shows enterprise-wide endpoint protection coverage, identifies vulnerable systems requiring immediate attention, and tracks security control effectiveness over time. IT Asset Management teams use this data for risk-based decision making during hardware refresh cycles and security policy enforcement.
Threat intelligence correlation and incident clustering
ServiceNow's Security Operations module correlates SentinelOne threat detections with external threat intelligence feeds to identify coordinated attacks, advanced persistent threats, and campaign-based activities targeting the organization. Multiple related incidents are automatically clustered into security investigations that track common indicators of compromise, attack timelines, and affected business services across the enterprise. Security analysts receive enriched context including MITRE ATT&CK technique mappings, threat actor attribution, and recommended countermeasures based on industry threat intelligence.
Orchestrated incident response with automated remediation
Complex security incidents trigger multi-step orchestration workflows that coordinate response actions across SentinelOne, network security tools, and ServiceNow service management processes. Workflows automatically collect forensic artifacts from affected endpoints, initiate containment procedures through SentinelOne's remote shell capabilities, coordinate with network teams for traffic analysis, and schedule follow-up vulnerability scans. The integration maintains real-time status updates and escalation procedures while ensuring all response activities are properly documented for post-incident review and regulatory compliance.
Troubleshooting
401 Unauthorized errors on SentinelOne API calls from ServiceNow
First, verify that the SentinelOne API token is correctly stored in the ServiceNow credential record by navigating to the credential and checking that the password field is populated. Test the token validity by making a direct API call to SentinelOne's authentication endpoint using a REST client with the same token. If the token is expired, regenerate it in SentinelOne Management Console and update the ServiceNow credential record, ensuring that any cached connections are cleared by restarting the MID Server if applicable.
Webhook notifications from SentinelOne not creating security incidents in ServiceNow
Check the System Logs > Outbound HTTP Requests for failed webhook deliveries and examine the error responses from ServiceNow's webhook endpoint. Navigate to System Web Services > Scripted REST APIs and test the webhook resource directly using ServiceNow's REST API Explorer with sample SentinelOne payload data. Verify that the webhook authentication mechanism matches between SentinelOne's configuration and ServiceNow's validation logic, and ensure that required fields in the security incident table have default values or are properly mapped from the webhook payload.
Flow Designer quarantine actions failing with timeout errors
Increase the timeout values in the REST step configuration within Flow Designer to accommodate SentinelOne's API response times, particularly for bulk operations that may take 30-60 seconds to complete. Check the MID Server logs if using an on-premises deployment to identify network connectivity issues or proxy configuration problems that could cause intermittent timeouts. Implement retry logic in the Flow Designer workflow using conditional branching that attempts the quarantine action up to three times with exponential backoff delays before escalating to manual intervention.
CMDB synchronization job processing duplicate or stale endpoint data
Implement proper delta synchronization logic by storing the last successful sync timestamp in a system property and using SentinelOne's API filtering parameters to retrieve only recently modified agents. Add uniqueness constraints and duplicate detection logic to prevent multiple CMDB records for the same physical endpoint, using a combination of serial number, MAC address, and computer name as correlation keys. Review the scheduled job execution history to identify performance bottlenecks and consider implementing batch processing with pagination for environments with large numbers of endpoints.
Security incidents showing incorrect severity or missing threat classification data
Verify that the webhook payload parsing logic correctly extracts all available threat attributes from SentinelOne's JSON structure, including nested objects for threat details and agent information. Update the field mappings between SentinelOne threat classifications and ServiceNow incident severity levels to align with organizational risk assessment frameworks. Check for API version compatibility issues that might cause field name changes or data structure modifications, and implement defensive coding practices that handle missing or null values gracefully while logging data quality issues for investigation.
Integration Hub flow steps failing with 'Connection Alias not found' errors
Confirm that the Connection Alias record is properly configured with the correct SentinelOne tenant URL and has an active status, checking that the referenced credential record exists and is not expired. Verify that Flow Designer steps are using the exact connection alias name as configured, including proper case sensitivity and no trailing spaces in the alias reference. If using a MID Server deployment, ensure that the connection alias is associated with the correct MID Server capability and that the MID Server has network connectivity to reach the SentinelOne Management Console endpoints on the required ports.
Pro Tips
- →Implement rate limiting protection in your custom scripts by adding GlideSystem.sleep() calls between bulk API requests to stay within SentinelOne's 100 requests per minute limit, and use the gs.getProperty() method to make these delays configurable through system properties for easy tuning in different environments.
- →Create custom ServiceNow tables to cache frequently accessed SentinelOne data like agent policies, threat signatures, and endpoint group memberships locally, reducing API calls and improving performance while implementing smart cache invalidation based on webhook notifications for data consistency.
- →Use ServiceNow's Event Management capabilities to create custom events for SentinelOne integration health monitoring, including API response time tracking, failed authentication alerts, and data synchronization status notifications that can feed into operational dashboards and alerting systems.
- →Leverage ServiceNow's Transform Maps and Import Sets for bulk data operations when initially populating CMDB records from SentinelOne, which provides better error handling, data validation, and rollback capabilities compared to direct GlideRecord operations in scheduled jobs.
- →Implement comprehensive audit logging for all SentinelOne API interactions by creating a custom audit table that tracks API calls, response codes, affected records, and user context, enabling detailed forensic analysis of integration activities and troubleshooting support for complex scenarios.
- →Configure ServiceNow's Outbound Email notifications to alert security teams when automatic quarantine actions fail or when critical threats are detected but cannot be immediately contained, ensuring human oversight remains in place for high-stakes security operations.
Known Limitations
- —SentinelOne's API rate limiting of 100 requests per minute per tenant can become a bottleneck in large environments with thousands of endpoints, requiring careful design of batch processing workflows and implementation of request queuing mechanisms to avoid API throttling during peak synchronization periods.
- —The integration lacks official ServiceNow Integration Hub spoke support, necessitating custom REST Message configurations and manual maintenance of API endpoint mappings, authentication handling, and error processing that would otherwise be provided by certified spoke implementations.
- —Real-time webhook delivery from SentinelOne depends on reliable network connectivity and proper firewall configuration, with no built-in retry mechanism for failed webhook deliveries, potentially causing missed threat notifications during network outages or ServiceNow maintenance windows.
- —SentinelOne's threat data model may not directly map to ServiceNow's Security Operations schema, requiring custom field extensions and data transformation logic that must be maintained as both platforms evolve their data structures and API versions.
- —The integration requires Integration Hub Professional licensing for advanced orchestration workflows and Flow Designer capabilities, limiting automation possibilities for organizations with Basic Integration Hub subscriptions and increasing overall licensing costs for comprehensive security automation.
Frequently Asked Questions
Can the SentinelOne integration work with ServiceNow's IT Operations Management (ITOM) Discovery to correlate discovered endpoints with protected agents?
Yes, the integration can leverage ServiceNow Discovery's CMDB population to create comprehensive endpoint inventories that combine discovered infrastructure data with SentinelOne agent protection status. Configure Discovery identification rules to match endpoints using MAC addresses or serial numbers as correlation keys, then use scheduled synchronization jobs to enrich discovered computer CIs with SentinelOne security posture data. This approach provides complete visibility into both managed and unmanaged endpoints, enabling identification of security gaps where Discovery finds systems without SentinelOne protection.
How does the integration handle SentinelOne agent updates and policy changes that might affect ServiceNow automation workflows?
The integration monitors SentinelOne agent status changes through webhook notifications and API polling to detect version updates, policy modifications, and configuration changes that could impact automated workflows. Flow Designer workflows include validation steps that verify agent capabilities before attempting quarantine or remediation actions, with fallback procedures for agents running older versions. Implement custom business rules that automatically update CMDB records when agent policies change, and create notifications to ServiceNow administrators when agent updates require workflow modifications or testing.
What authentication method should be used for production SentinelOne integrations and how often should API tokens be rotated?
Production integrations should use dedicated SentinelOne service accounts with minimal required permissions (IR Team role rather than Admin) and API tokens with defined expiration periods. Implement automated token rotation workflows using ServiceNow's credential management capabilities, scheduling new token generation every 90 days and updating Connection Alias credentials without service interruption. Store backup credentials and implement monitoring alerts that notify administrators 30 days before token expiration, ensuring continuity of security automation workflows during credential transitions.
Can ServiceNow trigger SentinelOne Deep Visibility queries for forensic investigation during incident response?
Yes, ServiceNow can initiate SentinelOne Deep Visibility queries through REST API calls to gather detailed forensic data including process execution history, network connections, file system changes, and registry modifications from affected endpoints. Create custom Flow Designer actions that construct Deep Visibility queries based on incident attributes like threat hashes, IP addresses, or time ranges, then automatically attach query results to security incidents as forensic evidence. Implement proper error handling for query timeouts and large result sets, and consider creating scheduled jobs to periodically check query completion status for long-running investigations.
How can organizations customize SentinelOne threat severity mapping to align with their ServiceNow incident management processes?
Create custom business rules and transform maps that translate SentinelOne's threat confidence levels, classification types, and risk assessments into ServiceNow incident priorities and severity levels based on organizational risk frameworks. Configure mapping tables that consider factors like affected business services, endpoint criticality from CMDB data, and threat actor attribution when determining incident severity. Implement dynamic severity adjustment logic that escalates incidents based on threat persistence, lateral movement detection, or multiple endpoint involvement, ensuring that ServiceNow incident priorities reflect actual business impact rather than just technical threat metrics.
What data retention and compliance considerations apply to SentinelOne threat data stored in ServiceNow?
SentinelOne threat data stored in ServiceNow security incidents and CMDB records must comply with data retention policies that may differ between security event data and service management records. Implement data lifecycle management workflows that archive or purge old threat intelligence data according to regulatory requirements while maintaining audit trails for compliance reporting. Configure field-level encryption for sensitive threat indicators like file hashes and network artifacts, and ensure that data export capabilities support forensic investigation requirements and legal discovery processes while protecting confidential threat intelligence sources.
How does the integration handle SentinelOne tenant migration or multi-tenant environments with separate ServiceNow instances?
Multi-tenant SentinelOne deployments require separate Connection Alias and credential configurations for each tenant, with careful namespace management to prevent cross-tenant data contamination in ServiceNow. Implement tenant-specific webhook endpoints and API configurations that route threat data to appropriate ServiceNow instances or business units based on endpoint ownership and organizational structure. Create standardized deployment packages using ServiceNow's Update Sets that can replicate integration configurations across multiple ServiceNow instances while maintaining tenant-specific customizations and security boundaries.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue