SentinelOne + D3 Smart SOAR
Automated Response Across Endpoints and Beyond
D3 provides a deep integration with SentinelOne Singularity XDR that brings the power of autonomous security into your Smart SOAR workflows. The best part is, it’s built and maintained by our team, not yours.
Benefits and Capabilities
With more than 40 commands, this feature-rich integration enables end-to-end automation at both the event and incident levels. With Smart SOAR and SentinelOne, workflows that would normally take 60-90 minutes can be executed in just 5-10 minutes.
- Ingest SentinelOne threats to trigger automated playbooks in Smart SOAR
- Update blacklists from Smart SOAR based on threat intelligence or investigation results
- Orchestrate SentinelOne actions from Smart SOAR, such as blocking hashes, retrieving agent info, and quarantining endpoints
- Enrich endpoint threats with D3’s full spectrum of security data
Use CAse
Endpoint Incident Response Automation
Smart SOAR can ingest threats from SentinelOne Singularity and then enrich, contextualize, and deduplicate the event. If the event is deemed a true positive, Smart SOAR will trigger an automated response playbook or assign the incident to an analyst for further investigation or approval. Analysts receive a comprehensive view of the event, including all available IOCs and any links to historical incidents.
- Triage events via D3’s Event Pipeline
- Orchestrate response actions like quarantining hosts, blocking hashes, and updating blacklists
- Automatically resolve the alert in SentinelOne when the response is complete
Use Case
Threat Hunting
Using Smart SOAR and SentinelOne as an integrated threat hunting solution speeds the investigation of new threats by streamlining the entire process from learning of the threat, to finding instances of it on endpoints, to quickly remediating it. All this can be orchestrated from Smart SOAR. Being able to build and trigger threat hunting playbooks in Smart SOAR also helps ensure consistency and reduce human error.
- Trigger endpoint scans and queries to find threats across the organization
- Automatically trigger scans for malicious hashes across endpoints
- Schedule threat hunting playbooks, or run them based on new intelligence
Why Smart SOAR?
Joint users of SentinelOne Singularity XDR and D3 Smart SOAR don’t just get automated endpoint security and threat hunting, they also get the countless other features that make Smart SOAR the leading independent SOAR solution, including:
Expert-built codeless integrations across the stack
Tier 1–3 automation, based on deep research into the capabilities of common tools
The Event Pipeline, which reduces alert volume by up to 98%
Cross-dimension correlation, which acts across tools, timeframes, TTPs, and artifacts
SentinelOne Integration: Summary
Integrations Done the Right Way
An unlimited number of pre-built integrations, expertly maintained by the largest technical team in security automation. Thoroughly researched, tested and built—and delivered for free. Always.
