1. From the SentinelOne sidebar, select the Settings menu.

2. Navigate to Integrations, then Syslog, and set SentinelOne Endpoint Security to forward logs to a Unified Security Stack agent on ports:

• 7012 TCP

• 7012 UDP

3. Enable log collector

To activate the log collector on the host running your Unified Security Stack agent, use the instructions below according to your operating system and chosen protocol.

4. Select Test to confirm connectivity with Unified Security Stack, then save the changes.

5. Select the button displayed below to enable the Unified Security Stack features tied to this integration.