Follow SentinelOne keeps three kinds of data worth exporting: endpoint telemetry, threats, and activities (the audit trail of what users and agents did in the console). Telemetry lives in Singularity Data Lake and has its own guide. Threats and activities come out of the management API (https://<console>.sentinelone.net/web/api/v2.1) with an ApiToken header, as JSON, page by page with a cursor.
When something goes wrong on a SentinelOne-protected network, the activity log often answers the uncomfortable questions. Who disabled that agent? Who added that exclusion? Who marked the threat as benign? Prime Core has 14,741 detection rules for SentinelOne, mapped to 644 MITRE ATT&CK techniques. Below is how to get the data out, sanitize it, and investigate it for free in LogTotal.
Before you start
An API token. Create a service user (or use your own user) with view rights at the account or site that holds the data, and generate its API token. Tokens expire; note when.
Your console URL. It’s the hostname you log in to, for example https://usea1-example.sentinelone.net.
Export activities and threats
S1="https://usea1-example.sentinelone.net/web/api/v2.1"
H="Authorization: ApiToken $S1_API_TOKEN"
URL="$S1/activities?createdAt__gte=2026-10-19T00:00:00Z&createdAt__lt=2026-10-20T00:00:00Z&limit=1000"
: > s1_activities_1019.jsonl
NEXT=""
while :; do
RESP=$(curl -sS -H "$H" "${URL}${NEXT:+&cursor=$NEXT}")
echo "$RESP" | jq -c '.data[]' >> s1_activities_1019.jsonl
NEXT=$(echo "$RESP" | jq -r '.pagination.nextCursor // empty')
[ -z "$NEXT" ] && break
done
For threats, swap /activities for /threats and save to another file. Both endpoints accept more filters, such as site IDs or activity types.
What to look for in activities
Look for agents being uninstalled, disabled or put into a less protective mode. Watch for new exclusions, especially broad paths. Check threats that were marked as resolved or benign without investigation, and policy changes. Look closely at console logins from unfamiliar places. Any of these, right before or during an incident, is worth a second look.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 | Token expired, or the header isn’t ApiToken <token> | Generate a new token; check the header |
| Empty results with a valid token | Token’s scope doesn’t cover the site | Use a user at the right scope |
| Only 1,000 records | Cursor not followed | Loop on pagination.nextCursor |
| No process telemetry here | Telemetry isn’t in the management API |
FAQ
Can I get the agent’s own logs?
The console can fetch agent logs from an endpoint for troubleshooting. Those are diagnostic files for support, not security telemetry.
What about Deep Visibility?
Deep Visibility was the earlier telemetry search. Current consoles use Singularity Data Lake; see that guide.
