SentinelOne Data Extraction Guide (for SIM Template)

SentinelOne collects endpoint telemetry and inventory data via its agent.
The relevant data for SIM import is sourced from:

• Endpoints / Agents – Device hostname and operating system details.

• Installed Applications – Software name, version, and publisher discovered on endpoints.

• SentinelOne REST API – Programmatic access to agent and application inventory data.

Note: Software inventory visibility requires Application Inventory to be enabled in your SentinelOne tenant.

Prerequisites

For Console (UI) Method

• Access to the SentinelOne Management Console.

• Role with permission to view Agents and Application Inventory.

• Endpoint agents actively reporting and fully initialized.

• Permission to export inventory data to CSV.

For API Method

• SentinelOne API Token with read-only access.

• Access to the SentinelOne API endpoint (e.g. https://<tenant>.sentinelone.net/web/api/v2.1/).

• A PowerShell, curl, or Postman environment to execute REST API calls.

• (Recommended) Familiarity with API pagination for large environments.

Recommended Query or Method

Two supported extraction methods are available.

Option 1: SentinelOne Console Export (UI)

This method is suitable for ad-hoc or smaller exports.

Steps

1. Log in to the SentinelOne Management Console.

2. Navigate to Inventory → Applications.

3. Apply filters as needed (e.g. all sites, all operating systems).

4. Ensure the following fields are visible:

   • Endpoint Name

   • Application Name

   • Version

   • Publisher

5. Click Export → CSV.

6. Save the file as SentinelOne_SIM_Export.csv.

Tip: You can save filters or views for recurring exports.

Option 2: SentinelOne REST API (Recommended for Automation)

For automated or large-scale exports, use the SentinelOne REST API.

Example PowerShell Script

# SentinelOne SIM Template Export Script
# Requires SentinelOne API Token with application inventory access

$BaseUrl = "https://your-tenant.sentinelone.net/web/api/v2.1"
$ApiToken = "YOUR_API_TOKEN"
$ExportPath = "C:\Exports\SentinelOne_SIM_Export.csv"

$Headers = @{
    "Authorization" = "ApiToken $ApiToken"
    "Accept"        = "application/json"
}

# Retrieve installed applications
$Url = "$BaseUrl/application-management/applications?limit=1000"
$Response = Invoke-RestMethod -Uri $Url -Headers $Headers -Method Get

$ExportData = @()

foreach ($App in $Response.data) {
    foreach ($Agent in $App.agents) {
        $ExportData += [PSCustomObject]@{
            "Device Name"        = $Agent.computerName
            "Software Name"      = $App.name
            "Software Version"   = $App.version
            "Software Publisher" = $App.publisher
        }
    }
}

# Export to CSV
$ExportData | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
Write-Host "Export complete: $ExportPath"

For large environments, loop through paginated results using the cursor or offset values returned by the API.

Exporting to CSV

• Console Method:
  Export directly from Inventory → Applications using Export → CSV.

• API Method:
  The PowerShell script generates SentinelOne_SIM_Export.csv automatically.

Ensure the CSV includes the following headers: