How to Export SentinelOne Singularity Data Lake Logs

Send a PowerQuery to the Singularity Data Lake API at /api/powerQuery on your regional Data Lake URL, for example https://xdr.us1.sentinelone.net. The response comes back as a table (columns plus rows), and one jq line turns it into one JSON object per event. Alternatively, export events directly from the Singularity console through Event Search. CSV is a commonly available export format, while JSON or plain-text downloads may be available depending on the interface.

Singularity Data Lake holds SentinelOne’s endpoint telemetry alongside any third-party logs you send it, so it’s often the widest view a SentinelOne customer has. Prime Core has 14,699detection rules for SentinelOne, mapped to 644 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.

Get Started For Free

Before you start

A service user with the right permissions. Create a service user for API access and give its role the Data Lake query permissions (SDL Query API and SDL Search). Create it at the account or site level that actually holds the data. A key made at the wrong scope authenticates fine and returns nothing.

Your regional URL. The US is typically https://xdr.us1.sentinelone.net; other regions use their own hostnames. The console’s help section lists yours.

Know the fields. Endpoint telemetry uses names such as endpoint.name, event.type, src.process.cmdline and tgt.process.cmdline. Third-party logs keep their original text in a message field. Try the query in Event Search first.

Export with the PowerQuery API

SDL="https://xdr.us1.sentinelone.net"

curl -sS -X POST "$SDL/api/powerQuery" \
  -H "Authorization: Bearer $S1_SDL_TOKEN" -H "Content-Type: application/json" \
  -d '{
    "query": "endpoint.name = \"WS-042\" | columns timestamp, endpoint.name, event.type, src.process.cmdline, tgt.process.cmdline",
    "startTime": "2026-10-19T00:00:00Z",
    "endTime": "2026-10-20T00:00:00Z"
  }' > sdl_ws042_1019.json

# table -> one JSON object per row
jq -c '.columns as $c | .values[] | [$c, .] | transpose | map({(.[0].name): .[1]}) | add' \
  sdl_ws042_1019.json > sdl_ws042_1019.jsonl

PowerQuery results are capped, so split long windows into several requests.

The columns stage decides what you get. Leave out fields you don’t need, but keep the command lines and process names: that’s where most detections look.

Export logs through the Singularity Data Lake UI

For quick investigations or smaller log samples, you can export events directly from the SentinelOne Singularity console without using the API.

1. Open Event Search. Sign in to the SentinelOne Singularity console and navigate to Event Search. Select the account or site containing your logs.
2. Set the time range. Choose the period you want to investigate and ensure the correct data sources are included.
3. Run a query. Enable PowerQuery and enter a search filter, for example endpoint.name = “WS-042”. Run the search.
4. Review results. Check the matching events and select the fields you need, such as timestamp, endpoint.name, event.type, src.process.cmdline and tgt.process.cmdline. Avoid aggregation functions if you need individual log events.
5. Export the results. Use the Export or Download option in the results area. Depending on the console version and search mode, you may be able to choose between CSV, JSON and plain text.
6. Save the file. Download the results to your computer. Prefer JSON when available, especially for structured endpoint telemetry. For third-party logs, preserve the message field containing the original log text.

Limitations. Export formats and result limits vary by console version and search mode. Large searches can also exceed the UI export limit; narrow the time range or use the Data Lake API for larger datasets.

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the .jsonl file. 
2. Sanitize. 
3. Review. 

When it goes wrong