What Changed

The connectorDefinition.json for the SentinelOne CCP connector has been restructured from a single-instance toggle flow to a multi-instance grid/context-pane flow (v3.0.10):

Removed:

  • Two standalone Textbox controls (Management URL, API Token)
  • ConnectionToggleButton (the single-instance connect/disconnect toggle)

Added:

  • Markdown instruction block explaining the Add new instance workflow
  • DataConnectorsGrid component displaying active connections with Management URL and a DeleteConnector menu item
  • ContextPane (DataConnectorsContextPane) titled Add new instance with required-validated Textbox controls for Management URL and API Token

This mirrors the multi-instance pattern used by other CCF connectors, allowing a single connector deployment to manage multiple SentinelOne management URLs with independent API tokens.

Security Impact

For MSSP operators or organizations with multiple SentinelOne instances, the prior single-instance model created a gap: only one management URL could be ingested at a time. Switching between tenants required manual reconfiguration. The multi-instance model closes this gap, enabling continuous parallel ingestion from all managed SentinelOne environments.

No changes to the polling logic, DCR, or data schema were made; this is a connector UX change only. Existing single-instance deployments will need to reconfigure using the new Add new instance flow after upgrading to v3.0.10.

Affected Files

Solutions/SentinelOne/Data Connectors/SentinelOne_ccp/connectorDefinition.json
(packaging artefacts: 3.0.10.zip, ReleaseNotes.md, Solution_SentinelOne.json, mainTemplate.json)