Integrations

# AI for SentinelOne

SentinelOne sees every threat and agent across your clients. Connected to Control Center, threats become tickets with the business context attached, isolation is approved from the ticket, and every device is checked for a healthy agent each morning.

- 5 automations
- 4 standards
- 2 reports
- 5 MCP questions

## Automations with SentinelOne

Work that runs on its own, across your tools. A person approves the steps that matter.
-
### Threats triaged before a tech looks

When SentinelOne flags a threat, a priority ConnectWise PSA ticket opens with who uses the device and what it can reach.
With ConnectWise PSA
-
### Isolation, approved from the ticket

A tech approves from the ConnectWise PSA ticket and SentinelOne isolates the device. Releasing it works the same way.
With ConnectWise PSA
-
### New clients onboarded on rails

A new client in ConnectWise PSA gets a checklist that tracks NinjaOne agents, SentinelOne coverage and Datto BCDR jobs until every device is done.
With ConnectWise PSA, NinjaOne and Datto BCDR
-
### Threats remediated on approval

A tech approves remediation from the ConnectWise PSA ticket, and SentinelOne cleans up the device.
With ConnectWise PSA
-
### Broken agents reinstalled

When an SentinelOne agent stops reporting, NinjaOne reinstalls it with your script once a tech approves.
With NinjaOne

## Standards checked in SentinelOne

Checked every morning, for every client. Fewer tickets, better security, and every gap is a project you can sell.
-
### SentinelOne on every device

Devices in NinjaOne without a healthy SentinelOne agent become a ticket.
With NinjaOne
-
### SentinelOne agents healthy

Agents offline, out of date or not reporting, at every client.
-
### Threats closed within 24 hours

SentinelOne threats still open after 24 hours, at every client.
-
### Agents on a supported version

SentinelOne agents running a version older than the one you approve.

## Reports from SentinelOne

Numbers from your tools, in the client’s language. Build a report from any data you connect.
-
### The whole QBR, drafted

ConnectWise PSA, NinjaOne, SentinelOne and Datto BCDR in one QBR, written in the client’s business terms for your vCIO to approve.
With ConnectWise PSA, NinjaOne and Datto BCDR
-
### Threats stopped

From SentinelOne, with what was at risk.

## Ask about SentinelOne in Claude or ChatGPT

Questions your team asks in Claude or ChatGPT, answered from every tool and client. Any answer can become a report or an automation.
-
### “Which devices at Northbridge don’t have SentinelOne?”

Answered from NinjaOne and SentinelOne.
-
### “What changed at Northbridge this week?”

Answered from ConnectWise PSA, NinjaOne and SentinelOne.
-
### “What did SentinelOne catch at Northbridge this month, and was any of it real?”

Answered from SentinelOne.
-
### “Which devices are isolated right now, and why?”

Answered from SentinelOne.
-
### “Which devices at Meridian have an SentinelOne agent that stopped reporting?”

Answered from SentinelOne.

## What Control Center reads from SentinelOne

Threats, agent health, isolating devices and remediation.

Control Center connects to SentinelOne through its public API. You add it once, then choose which clients it covers and which API operations it can use. The key goes in Control Center’s vault, never in a chat.
What you need: The API reference and API tokens are inside your SentinelOne management console.
The examples on this page use a stack MSPs often run with SentinelOne: ConnectWise PSA, NinjaOne and Datto BCDR. Build your AI plan to see them with your own tools.
[Connection details and what you need from SentinelOne](https://www.resultsiq.ai/docs/tools/s1/)

## Questions about SentinelOne and Control Center

### Does Control Center work with SentinelOne?

Yes. Control Center connects to SentinelOne through its public API and uses threats, agent health, isolating devices and remediation. You add it once, then choose which clients it covers.

### What can an MSP automate with SentinelOne and AI?

With Control Center, 5 automations, including: threats triaged before a tech looks; isolation, approved from the ticket; new clients onboarded on rails; threats remediated on approval; broken agents reinstalled. A person approves the steps that matter.

### Can I use SentinelOne with Claude or ChatGPT?

Yes, through Control Center MCP. Your team connects Claude or ChatGPT once and can ask about SentinelOne at every client, with the same roles and client scopes as their login. For example: “Which devices at Northbridge don’t have SentinelOne?”

### What does it cost?

$1,750 a month for the Control Center platform plus $75 a month per billable workflow, with the first 90 days at no cost.
