Security
SOC Enrichment With Identity Events
Send your tenant's identity activity straight to your security operations tools.
All product updates
Integrations · Security
SentinelOne AI SIEM Integration
Privileged changes, AI agent permission changes and Hydden risk findings now reach SentinelOne as alerts your analysts can act on.
Use case
Most SIEM identity content stops at the login. The events that decide how bad an incident is, like a privileged group add, a role grant or an AI agent gaining a permission, stay in the governance tool while the analyst works somewhere else.
Hydden already knows which identities are privileged, which AI agents they own and how far each one can reach. It now sends that to SentinelOne, with dashboards, detections and response workflows built for the people who work incidents.
Why it matters
Analysts see who an identity is and what it can reach on the alert itself, so triage starts with the answer instead of a search in another tool.
How it works
1. Hydden sends identity events
Account changes, privileged grants, AI agent activity and Hydden findings stream into SentinelOne.
2. SentinelOne alerts on what matters
Privileged changes and Hydden findings become alerts in the same queue as everything else.
3. Analysts act with approval
Check blast radius from the alert, then contain the account only after an explicit yes.
Screens and documentation
Available to all Hydden customers who run SentinelOne AI SIEM. Your Hydden contact can walk you through connecting the two.
Need configuration detail? Technical documentation is available to customers after sign-in.
Key benefits
Let's say John, a security admin, has connected Hydden to his identity stack, and his SOC runs SentinelOne. SentinelOne flags that one of his users has been phished. Here is what Hydden does.
- Turns the user into one identity, with every account it holds across every system.
- Writes the blast radius onto the alert: how privileged each account is and what it can reach.
- Shows the identity changes around it, like a privileged group add the night before.
- Removes the account where it lives once the analyst approves, and nothing runs without that approval.
- Sends the action back to SentinelOne as an event, next to the detection that started it.
Related updates
All updatesAI agents
Hydden MCP Updates
Your AI agents can query the identity record and act on it, within the roles you grant.
NewAI agents
AI Agent Profiles And Blast Radius
See every AI agent, what it has done, and how much any identity can reach.
Bring identity into your SentinelOne alerts
Request a trial and see Hydden events in your SOC.