SentinelOne integrates with ServiceNow

Press release announcement:

SentinelOne Integrates with ServiceNow to Unify IT and Security

Joint Workflows Deliver Automation Efficiency and Broad Response Actions

SentinelOne (NYSE: S), an autonomous cybersecurity platform company, today announced the SentinelOne App for ServiceNow Security Incident Response (SIR). The integration unites security and IT teams for more effective incident response.

With SentinelOne integrated directly into ServiceNow, joint customers can use the ServiceNow platform to triage threats. The integration helps security and IT teams accelerate a coordinated, comprehensive, and automated incident response plan across endpoint and cloud environments. The app is available via theSentinelOne Singularity Marketplace and the ServiceNow® Store.

“The industry is under constant attack every day, as organizations grapple with vulnerabilities like log4j. Having enterprise-wide visibility and protection from SentinelOne Singularity helps our team understand the potential impact in just a few clicks. We use ServiceNow as our incident management and workflow automation platform - together our team has a single pane of glass for incident collaboration to mitigate threats in real-time.” - Identity and Endpoint Security Architect, Global Manufacturer

As ransomware and other forms of malware become increasingly prevalent, both IT and security teams need to operate in lockstep to prevent attacks. Unfortunately, many enterprises rely on numerous unconnected tools to operate cybersecurity programs. The resulting inefficiency and alert fatigue leads to unnecessary cyber incidents posing enterprise risk. XDR solutions change the paradigm, reframing cybersecurity as a data and workflow problem in need of automation.

The SentinelOne App for ServiceNow Security Incident Response instantly syncs threats from SentinelOne into the ServiceNow Incident Response module for a unified security program. Within ServiceNow, an incident responder can view all relevant incident details around the threat, including incident status and threat notes, as well as any additional context or notes created within either platform. When the incident responder determines that corrective action needs to occur, ServiceNow can trigger automated response actions in SentinelOne to kill, quarantine, remediate or even roll back any potential effects from the threat.

Saul: Has to be goodness for Sentinel One


Thanks Saul. This is great news. Also a most required integration. CRWD and VMware Carbon Black, just to mention some modern ADR tools, already have it (quick search online). With ServiceNow being the #1 helpdesk solution in the market, having automated ticket creation is seen as another important step on the pro-active threat detection and resolution.
S is “an inch” away from the Forrester Leaders section and partnerships like this show how the security ecosystem is taking it seriously.


Servicenow is pursuing a platform approach with its NOW platform where it becomes the action layer where different apps can be integrated into.

I am not sure how significant this piece of news is but many many apps are already integrated into NOW (including Crowdstrike since last year).