Hi,

We are currently ingesting SentinelOne alert logs into SecOps. For this integration, we initially selected the Admin role from the default SentinelOne roles. However, our customer has raised concerns about this choice due to compliance reasons — specifically, they prefer not to assign full admin rights just for log collection.

Does anyone have recommendations on which default role would be best suited for this purpose, following best practices? Alternatively, could anyone share which specific permissions should be enabled to allow log access while maintaining a minimal permission approach?

Here are the list of default roles:
-Admin, C level, IR Team, Viewer, IT, SOC

Thanks in advance!