SentinelOne Deployment

Overview

The SentinelOne + EnforceDNS integration offers a powerful, deployment path that enables DNS-layer threat protection using your existing SentinelOne footprint and Agent. By leveraging SentinelOne’s Cloud Funnel, EnforceDNS gains visibility into DNS activity across all managed endpoints—both on-network and remote—without needing to install a separate agent.

This integration not only allows EnforceDNS to detect and report on suspicious DNS activity, but optionally block malicious domains by dynamically updating SentinelOne’s Network Control firewall rules. It’s a fast and seamless way to roll out Protective DNS across your organization using infrastructure already in place.

If you're looking for rapid deployment with minimal friction, this option is a great fit—especially for environments that already rely on SentinelOne for endpoint security.

Prerequisites

• SentinelOne is deployed on all target endpoints (Windows/macOS)

• Cloud Funnel is licensed and enabled in your SentinelOne environment

• You have access to the SentinelOne console and EnforceDNS portal

• SentinelOne Role/Access Requirements

  • Optional, if blocking, API Token created from a service user with:

    • Account level scope access: Account

• Minimum Built-in RBAC Role: Standard built-in RBAC role not recommended

  • Custom Role Requirements: Firewall -> Manage Rules and Tags=Allowed

Key Features, Benefits & Considerations

SentinelOne Deployment and Configuration Overview

By integrating EnforceDNS and SentinelOne, it’s easy to deploy EnforceDNS rapidly and easily throughout an organization. It enables all the EnforceDNS protection and blocking access to malicious domains. There are 2 parts to the integration:

1. Reading all DNS query logs to gain visibility into DNS traffic (required for integration)

2. Blocking access to malicious domains (optional)

Deployment

S3 Bucket Creation

1. Create an S3 Bucket on AWS for storing logs using SentinelOne’s recommended settings

   1. Instructions Here

Enabling Cloud Funnel Streaming

1. On SentinelOne enable Cloud Funnel streaming

   1. Instructions Here

Configure Integration in EnforceDNS

1. In EnforceDNS go to Configuration -> SentinelOne

   

2. Set the integration to “Enabled” 

   

3. Configure the details of the AWS S3 bucket as configured in step 1

   

4. Click “Verify Access” to ensure everything is working correctly.

   

Enable Blocking - Optional

1. Obtain your SentinelOne Account ID

   1. In SentinelOne, navigate to Sentinels>Account Info. Your account ID will be in the on the left side of the page under your account name.

2. Obtain SentinelOne API Token

   1. In SentinelOne create a new role with only the the following permissions

      1. Firewall -> Manage Rules and Tags = Allowed

      2. Instructions on creating a new role Here

   2. Create a Service User and assign the aforementioned role.

      1. Choose the Access Level Global or Account

      2. Make note of the API token generated as it is needed to complete the configuration and cannot be retrieved later (only reset)

      3. Instructions on creating a Service user Here

3. Enter the SentinelOne Account ID, API Key and Tenant URL as configured in previous steps.

   

4. Click 'Verify SentinelOne Access’

5. Click 'Save'

6. Blocking is now configured.

SentinelOne Deployment Checklist & Verification

Configuring Policies

Now that you’ve successfully deployed EnforceDNS, your environment is already safeguarded against malicious domains—including phishing sites, malware delivery networks, and command-and-control (C2) infrastructure (among others). These threats are blocked by default using HYAS’s infrastructure intelligence and real-time decision engine.

If you'd like to customize your protection further, you can configure additional policies—such as blocking unwanted content categories, managing allow/block lists, or tailoring behavior by source network or user group. [Learn how to configure policies →]