---
updatedAt: 2026-09-08T20:33:43.000Z
agentTools:
  projectIndex: https://docs.censys.com/llms.txt
---

# SentinelOne Integration

The Censys for SentinelOne Singularity Operations Center integration adds the ability to: 

* Automatically or manually enrich IPs, web properties, and certificates in SentinelOne with Censys Platform data. 
* Initiate a Censys rescan of a host or web property.
* Retrieve scan history for an IP address. 
* Initiate a <Anchor target="_blank" href="https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections">CensEye</Anchor> automated pivoting job to find assets related to an IP, web property, or certificate.

These actions can be executed using five pre-built Hyperautomation workflows.

This guide walks through how to set up and use the Censys for SentinelOne application.

<Callout icon="📘" theme="info">
  ### Note

  Most of the Censys API calls used by this integration will deduct credits from your organization's balance. Reference the <Anchor target="_blank" href="https://docs.censys.com/reference/get-started">API documentation</Anchor> for more information on credit costs.
</Callout>

## Prerequisites

* SentinelOne Singularity Operations Center version S-26.1.6.134 or a higher active GA version that supports Hyperautomation workflows and integrations.

* To configure and manage the integration in SentinelOne, you must have a SentinelOne user with the following minimum permissions.
  * View and Edit permissions for Hyperautomation.
  * Run, Stop, Export, and Delete workflow permissions.

* Your Censys Platform organization ID.
  * To obtain your organization ID:
    1. Open the Platform web console and ensure that your organization account is selected. Go to **Settings > Account Management > Personal Access Tokens**.
    2. The ID for your organization is shown in the "Current Organization" box. Click **Copy** to copy it to your clipboard.

       <Image src="https://files.readme.io/7987845077501dc8a00bc1730b50ce9c902522d0a164f7f9a62a3d90684a8685-Screenshot_2026-01-22_at_2.27.17_PM.png" align="center" border={true} />

* A Censys Platform Personal Access Token (PAT). <Anchor target="_blank" href="https://docs.censys.com/reference/get-started#step-2-create-a-personal-access-token">Instructions on how to create and manage PATs are available in the API documentation</Anchor>.

## Installation and configuration

To set up the Censys integration, you must add the Censys integration connection, create global variables for the integration to use your organization ID in all API calls and optionally to use the <Anchor target="_blank" href="https://docs.censys.com/docs/host-enrichment">host enrichment API</Anchor>, create a SentinelOne connection for adding notes to alerts, and create a SentinelOne SIEM HTTP Event Collector (HEC) connection to ingest Censys data into the Singularity Data Lake (SDL).

After you set up the integration's connections, you must configure the workflows to use your new connections. See the Workflow configuration section below this for more information.

### 1. Add the Censys connection to SentinelOne

1. Access your SentinelOne dashboard as a user with permissions described above. Go to **Hyperautomation > Integrations**.&#x20;
2. Search for "Censys". Select the **Censys** card and click **Add Connection**.&#x20;
3. On the "Create Connection" page, under "Authentication," enter your Censys PAT in the "API Key" field.
4. Leave all other options at their default settings and click **Create Connection**.&#x20;

### 2. Create global variables for the Censys integration

1. On the **Integrations&#x20;**&#x70;age, select **Variables**. Click **Create New**.&#x20;
2. In the "Name" field, enter `Censys-Org-Id`. Note that this name value is case sensitive.&#x20;
3. In the "Value" field, paste your Censys organization ID.&#x20;
4. Click **Create**.

#### Optional: configure host enrichment API global variable

You may also configure a global variable to use the <Anchor target="_blank" href="https://docs.censys.com/docs/host-enrichment">host enrichment API endpoint</Anchor> instead of the <Anchor target="_blank" href="https://docs.censys.com/reference/v3-globaldata-asset-host">get host API endpoint</Anchor> when retrieving information about hosts. The host enrichment API returns a curated set of host IPv4 or IPv6 data designed specifically for high-volume, automated lookups in SOC environments.

If you do not configure this global variable, then the integration workflows will use the get host API.

To use the host enrichment API, your organization must be on the Core plan. The host enrichment API does not cost credits to use. Core organizations are limited to 20,000 host enrichment calls per day. Core + Unlimited Enrichment organizations may perform an unlimited number of host enrichment API calls.

If you configure this variable, then the SentinelOne workflows will call this endpoint by default when enriching hosts. If you hit your limit, then it will fall back to the get host endpoint.

To configure the host enrichment API variable:

1. On the **Integrations&#x20;**&#x70;age, select **Variables**. Click **Create New**.
2. In the "Name" field, enter `Censys-Use-Host-Enrichment-API`. Note that this name value is case-sensitive.
3. In the "Value" field, enter `true`.
4. Click **Create**.

### 3. Create SentinelOne connection for adding notes to alerts

1. Go to **Hyperautomation > Integrations**.&#x20;
2. Search for "SentinelOne." Select the **SentinelOne&#x20;**&#x63;ard and click **Add Connection**.
3. On the "Create Connection" page:
   * In the "Connection Name" field, enter a name like "SentinelOne."
   * Under "Network," in the "URL" field, enter your SentinelOne management console URL.
   * Under "Authentication," in the "API Token" field, enter a SentinelOne API token with permission to read and update alerts.
     * To create an API token for a user, go to **User Management > Console Users&#x20;**&#x6F;r **User Management > Service Users**. Select the user you want to create a token for, then click **Actions > API token operations > Generate API token**.
4. Click **Create Connection**.

### 4. Create SentinelOne SIEM HEC connection to ingest Censys data into SDL

1. Go t&#x6F;**&#x20;Hyperautomation > Integrations.**
2. Search for "SentinelOne SDL." Select the **SentinelOne SDL&#x20;**&#x63;ard and click **Add Connection**.
3. On the "Create Connection" page:
   * In the "Connection Name" field, enter a name like "SentinelOne SDL."
   * Under "Network," in the "URL" field, enter your HEC ingest URL, like `https://ingest.us1.sentinelone.net`.
   * Under "Authentication," in the "API Token" field, enter your SIEM write token.
4. Click **Create Connection**.

## Workflows and actions

The Censys for SentinelOne integration includes the following workflows.

| Workflow                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| :------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Censys Alert Enrichment          | Automatically enriches alerts with Censys intelligence for IP addresses, web properties, and certificate hashes found in alert indicators, ingests the raw data into the Singularity Data Lake, and appends a formatted summary note to the alert.                                                                                                                                                                                                                                                                                                                                                                   |
| Censys Alert Enrichment (Manual) | Manually enriches an alert with Censys intelligence for a specified IP address, web property, or certificate hash, ingests the raw data into the Singularity Data Lake, and optionally appends a formatted enrichment note to the alert.                                                                                                                                                                                                                                                                                                                                                                             |
| Censys Host History Enrichment   | Manually retrieves the historical scan timeline for a specified IP address from Censys, ingests each scan event into the Singularity Data Lake, and optionally appends a formatted host history summary as a note to an alert.                                                                                                                                                                                                                                                                                                                                                                                       |
| Censys Rescan                    | Manually triggers a <Anchor target="_blank" href="https://docs.censys.com/docs/platform-live-rescan">rescan </Anchor>of a service or web property in Censys, polls for scan completion, fetches the updated asset data, ingests the results into the Singularity Data Lake, and optionally appends a formatted enrichment note to a SentinelOne alert.                                                                                                                                                                                                                                                               |
| Censys Related Infrastructure    | Manually initiates a <Anchor target="_blank" href="https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections">CensEye</Anchor> job for a specified IP address, web property, or certificate to discover assets that return specific key-value attributes, ingests the job results into the Singularity Data Lake, and optionally appends a formatted summary of findings to an alert.<br /><br />This workflow is only available to users with access to the <Anchor target="_blank" href="https://docs.censys.com/docs/platform-threat-hunting">Adversary Investigation module</Anchor>. |

The integration also adds the following actions. Many of these actions are included in the pre-built workflows.

| Action                      | Description                                                                                                                                                                                                                                                                                  |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Get Host                    | Retrieves current scan data and open service information for a given <Anchor target="_blank" href="https://docs.censys.com/docs/platform-host-dataset">host</Anchor>.                                                                                                                        |
| Get Host Enrichment         | Retrieves host data using the <Anchor target="_blank" href="https://docs.censys.com/docs/host-enrichment">host enrichment API</Anchor>, a lightweight API purpose-built to help security teams operationalize external internet data without the friction of traditional credit consumption. |
| Get Web Property            | Retrieves current scan data for a given <Anchor target="_blank" href="https://docs.censys.com/docs/platform-web-property-dataset">web property</Anchor>.                                                                                                                                     |
| Get Certificate             | Retrieves details and metadata for a TLS/SSL <Anchor target="_blank" href="https://docs.censys.com/docs/platform-certificate-dataset">certificate</Anchor> identified by its SHA256 hash.                                                                                                    |
| Get Host History            | Retrieves the historical scan timeline for a given IP address within a specified date range, showing how the host's exposed services have changed over time.                                                                                                                                 |
| Initiate Live Rescan        | Triggers a live rescan of a specific service (IP + port + protocol) or web property in Censys, returning a scan ID to track progress.                                                                                                                                                        |
| Get Scan Status             | Checks the current status of a live rescan using the scan ID returned by Initiate Live Rescan.                                                                                                                                                                                               |
| Create CensEye Analysis Job | Starts a pivot-based threat hunting job for a given host, web property, or certificate, returning a job ID to track progress.                                                                                                                                                                |
| Get CensEye Job Status      | Checks whether the analysis job is still running, completed, or has timed out.                                                                                                                                                                                                               |
| Get CensEye Job Result      | Retrieves the paginated results of a completed analysis job, listing related assets grouped by shared attribute values.                                                                                                                                                                      |

### Workflow configuration

Use the following steps to add connections to your workflows and activate them. You must configure any step in a workflow that makes a Censys API call to use the connections you created above.&#x20;

To add connections to a workflow:

1. Go to **Hyperautomation > Workflows**.&#x20;
2. Open the workflow you want to edit.
3. Click on any step that makes a Censys API call (such as Get Host, Get Certificate, Get Web Property, Initiate Live Rescan, and Get Host History).
4. In the step's settings panel, set the **Set as Integration&#x20;**&#x74;oggle to **On**.&#x20;
5. In the dropdown beneath "Set as Integration," select **Censys**.
6. In the "Connection Information" section, select the Censys connection you created during the "Add the Censys connection to SentinelOne" part of the setup process.

   <Image src="https://files.readme.io/61b2ad104872645a6e06b2e6a3a191250f6c5674506712bc4b3fc63a1c044c78-Screenshot_2026-09-01_at_1.10.06_PM.png" border={true} />

   1. Repeat this for all steps that call the Censys API.
7. Click on any step that sends data to the SDL (such as Send Certificate Log Entry to SDL, Send Host Log Entry to SDL, Send Host History to SDL, and Send Host Enrichment Data to SDL).
8. In the step's settings panel, set the **Set as Integration&#x20;**&#x74;oggle to **On**.
9. In the dropdown beneath "Set as Integration," select **SentinelOne SDL**.
10. In the dropdown beneath "Set as Integration," select the SentinelOne SDL connection you created during the "Create SentinelOne SIEM HEC connection to ingest Censys data into SDL" part of the setup process.

    <Image src="https://files.readme.io/49f1874718b2df5d88763b7bd01ce42dff795f9133e15e427e36603e36ed6dd7-Screenshot_2026-09-01_at_1.14.58_PM.png" border={true} />

    1. Repeat this for all steps that send data to SDL.
11. Click on any step that adds a note to an alert (such as Add Certificate Hash Note to Alert).
12. In the step's settings panel, set the **Set as Integration&#x20;**&#x74;oggle to **On**.
13. In the dropdown beneath "Set as Integration," select **SentinelOne**.
14. In the dropdown beneath "Set as Integration," select the SentinelOne connection you created during the "Create SentinelOne connection for adding notes to alerts" part of the setup process.

    <Image src="https://files.readme.io/c92d101994c6470793ad5eaa6a7eb63512b861fd4fc49bb86b015353f1e87940-Screenshot_2026-09-01_at_1.21.12_PM.png" border={true} />

    1. Repeat this for all steps that add notes to alerts.
15. After configuring each step, click **Activate**.

## How to use Censys for SentinelOne workflows

### Censys Alert Enrichment

This workflow runs automatically. No manual action is needed. Whenever a `MEDIUM`, `HIGH`, or `CRITICAL` alert is created in SentinelOne, the workflow triggers and enriches it with Censys data.

<Image src="https://files.readme.io/9963b4c9cb35a857f392f054577ce504a890ed518c73c86bfe111cf8ee1f029a-Screenshot_2026-09-02_at_3.19.38_PM.png" align="center" width="60%" caption="A note containing Censys host enrichment added to a SentinelOne alert." border={true} />

<Image src="https://files.readme.io/2ec54fb24d254d578cf49858a8aacf38f4f52e46fa41f6c26943cc100edc05f0-Screenshot_2026-09-02_at_3.19.50_PM.png" align="center" width="60%" caption="Service data for a host enriched with Censys data." border={true} />

### Censys Alert Enrichment (Manual)

1. Open the workflow and click **Execute**.
2. Fill in the prompt fields:
   * Alert ID (optional): the SentinelOne alert ID to attach the enrichment note to.
   * Host (optional): IP address of the host to look up (such as `8.8.8.8`).
   * Web Property (optional): Hostname and port pair of the web property to look up (such as `example.com:443`).
   * Certificate (optional): Certificate SHA256 hash to look up.
3. Click **Run**.

### Censys Host History Enrichment

1. Open the workflow and click **Execute**.
2. Fill in the prompt fields:
   * Alert ID (optional): the SentinelOne alert ID to attach the enrichment note to.
   * Host: IP address of the host to look up.
   * Start time: history start date in the format `YYYY-MM-DDTHH:MM:SSZ` (for example, `2024-01-01T00:00:00Z`).
   * End time: history end date in the same format.
3. Click **Run**.

### Censys Rescan

1. Open the workflow and click **Execute**.
2. Fill in the prompt fields:
   * Alert ID (optional): the SentinelOne alert ID to attach the findings to.
   * Scan Type: enter `S` to scan a host service (IP, port, and protocol), or `WP` to scan a web property (hostname and port).
   * Host: IP address or hostname (for example `8.8.8.8` or `www.example.com`).
   * Port: Port number.
   * Protocol: The protocol of the target service (required for service scans), such as `HTTP`.
   * Transport protocol: The transport protocl of the target service (required for Service scans), such as  `tcp`.
3. Clic&#x6B;**&#x20;Run**. The workflow will poll Censys for scan completion (up to 10 minutes) and then ingest the results.

### Censys Related Infrastructure

1. Open the workflow and click **Execute**.
2. Fill in the prompt fields:
   * Alert ID (optional): the SentinelOne alert ID to attach the findings note to.
   * Host IP (optional): Host IP address to pivot from.
   * Web Property (optional): Web property to pivot from.
   * Certificate (optional): Certificate SHA256 hash to pivot from.
3. Click **Run**. The workflow will poll Censys until the threat hunting job completes (up to 10 minutes), then ingest the results.

## Data written to the SDL

All workflows ingest Censys raw data into the Singularity Data Lake under the following source metadata:

| Censys Action or Workflow | `dataSource.vendor` | `dataSource.category`   | `source`                       |
| ------------------------- | ------------------- | ----------------------- | ------------------------------ |
| Host enrichment           | `Censys`            | `HostEnrichment`        | `Censys.HostEnrichment`        |
| Web property enrichment   | `Censys`            | `WebPropertyEnrichment` | `Censys.WebPropertyEnrichment` |
| Certificate enrichment    | `Censys`            | `CertificateEnrichment` | `Censys.CertificateEnrichment` |
| Host history enrichment   | `Censys`            | `HostHistoryEnrichment` | `Censys.HostHistoryEnrichment` |
| Rescan                    | `Censys`            | `Rescan`                | `Censys.Rescan`                |
| Related infrastructure    | `Censys`            | `RelatedInfrastructure` | `Censys.RelatedInfrastructure` |

You can query this data in the SDL using a filter such as:

```
dataSource.vendor='Censys' dataSource.category='HostEnrichment'
```