+

End-to-End Visibility,
Threat Detection,and Remediation
Empowered by XDR
SentinelOne & Zscaler Joint Solution Brief©2023 Zscaler, Inc. All rights reserved.

+End-to-End Visibility, Threat Detection, andRemediation Empowered by XDR
SentinelOne & Zscaler Joint Solution Brief
Market Challenges
Today’s enterprise technology stacks are complex – with distributed applications, users, and endpoints,
an ever-expanding list of IoT devices, and new sanctioned and unsanctioned tools being deployed daily.
As attack vectors multiply, from endpoints to networks to the cloud, security teams struggle to secure
their valuable assets inside and outside the traditional network perimeter.
The more security controls that security operations teams deploy, the more alerts they get, but too often,
the signal is buried in the noise. Security analysts are forced to pivot between tools that do not integrate
and fail to connect the dots across the entire technology stack. As a result, security data is collected andanalyzed in isolation, without any context or correlation, creating gaps in what security teams can seeand detect, leading to longer dwell times. This complexity has necessitated a new approach to securing
access—one that provides frictionless security from endpoint to network to application.

Joint Solution
Together, SentinelOne and Zscaler unify to provide enterprise security across endpoint, network, andcloud, enabling enhanced end-to-end visibility, accelerated remediation, seamless sandboxing, andsecure conditional access. The SentinelOne Singularity Platform, powered by Singularity Data Lake,
continuously protects, detects, and responds to threats
across endpoints, identities, and cloud workloads withunified analytics. The Zscaler Zero Trust Exchange
provides secure access to internet, SaaS apps, andIntegration Benefits

private apps for all users from any device or location,• Accelerate remediation withwith inline AI-powered traffic inspection and advanced

cross-platform response

threat protection. With seamless integration between
SentinelOne and Zscaler, security teams can minimize
risk and block threats outright, while also accelerating
investigations and remediating threats faster without
pivoting between consoles. Security operation centers• Minimize data silos withinyour environment• Increase efficiency of incident
triage and investigation

can triage, investigate, and remediate threats much more
efficiently and with greater confidence.

©2023 Zscaler, Inc. All rights reserved.

SentinelOne & Zscaler Joint Solution Brief

2+Joint Solution Highlights

Zero Trust Security with Advanced Threat Protection and End-to-End Visibility

Threat Enrichment with User Attributes, URL Lookups, and Sandbox Analysis

Accelerated One-Click Remediation

Zero Trust Conditional Access

Key Use Cases
Comprehensive Visibility
SentinelOne and Zscaler integrate for expanded visibility to provide security teams with a holisticunderstanding of threat context and user attributes, allowing them to quickly triage and respondto attacks. While Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) offer secureinternet, SaaS, and zero trust network access, the Singularity Data Lake continuously
ingests Zscaler logs for deeper visibility and accelerated investigation
with AI-assisted analytics. Once logs ingested into the Data Lake
are normalized to the Open Cybersecurity Scheme Framework(OCSF) for faster correlation and analytics, security analysts caninvestigate threats in the SentinelOne console, without having
to constantly switch between multiple dashboards.
Expanded Enrichment
The SentinelOne and Zscaler integration provides further
threat enrichment with correlated user details, related
Zscaler threats, and URL look-ups. When a threat isdetected by SentinelOne, Zscaler automatically correlates
user attributes, such as if the user is an admin, theirdepartment, or if they are linked to any specific groups
in the company. When applicable, URL lookup details
are also shared and viewable within the XDR Feed of the“Today’s security challenges
require defense in depth.
SentinelOne and Zscaler are
key components in our security
stack that help us advanceour overall security posture.
Together, Singularity XDR andZscaler automate the triage andinvestigation functions in theSOC, enabling a small team to
respond against threats withspeed and accuracy.”

John McLeod
CISO of NOV

SentinelOne console, such as Zscaler’s categorization of theURL and other relevant information.

©2023 Zscaler, Inc. All rights reserved.

SentinelOne & Zscaler Joint Solution Brief3

Accelerated Remediation
With the integration, SentinelOne and Zscaler enable security analysts to accelerate response with policydriven actions that remediate threats automatically in Zscaler from the SentinelOne console. Analysts cantrigger manual or automatic response actions to mitigate threats, moving users to a destination group wherea specific policy can be applied. This includes limiting user access, quarantining a user, blocking access to one
or a group of critical applications, or rendering applications in isolated containers with restricted functionality
to limit an attacker’s ability to infiltrate and launch an attack.
Seamless Sandboxing
With the threat detection capabilities of the Singularity Platform in combination with Zscaler Sandbox,
security teams benefit from a seamless sandbox analysis experience to further enrich threats. Based on thesecurity team’s configuration, when SentinelOne detects a threat, it can automatically send the threat file toZscaler for sandbox analysis. Zscaler Sandbox provides AI-powered deep inspection and detonates the file ina virtual environment to detect any malicious behavior. The additional intelligence from the sandbox analysis
is then directly observable in the SentinelOne console, such as threat classification, origin risk, risk summary,and detected malware.
Zero Trust Conditional Access
The SentinelOne and Zscaler Zero Trust Exchange integration enables seamless conditional access, ensuringthat the trusted identity on a trusted device can directly access authorized corporate applications without
exposing the network.
Zscaler and SentinelOne combine to provide best-in-class Zero Trust access control with unparalleledvisibility, threat protection, AI-powered detection, and automated response across endpoints, applications,and cloud workloads. SentinelOne continuously checks policy and enforces compliance on the endpoint. At
the time of access, Zscaler checks whether SentinelOne is installed and running running and considers thisdevice posture as part of its dynamic risk analysis to grant or deny application access.

Zero Trust Conditional Access

Extended Visibility & Accelerated Remediation

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data lossby securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloud security platform. Learn
more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134©2023 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,ZIA™, Zscaler Private Access™, and ZPA™ areeither (i) registered trademarks or service marksor (ii) trademarks or service marks of Zscaler,Inc. in the United States and/or other countries.
Any other trademarks are the properties of theirrespective owners.

zscaler.com