diff --git a/integrations/sentinelone/incident-types/sentinelone-threat.yaml b/integrations/sentinelone/incident-types/sentinelone-threat.yaml
new file mode 100644
index 0000000..fe52f8f
--- /dev/null
+++ b/integrations/sentinelone/incident-types/sentinelone-threat.yaml
@@ -0,0 +1,3 @@
+name: "SentinelOne Threat"
+color: "#a020f0"
+icon: "alert"
diff --git a/integrations/sentinelone/manifest.yaml b/integrations/sentinelone/manifest.yaml
index 936b652..55b9f80 100644
--- a/integrations/sentinelone/manifest.yaml
+++ b/integrations/sentinelone/manifest.yaml
@@ -43,6 +43,10 @@ commands:
         created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
       required: []
     outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: id
+      incremental_field: created_after
 
   - id: list_agents
     name: sentinelone-list-agents
@@ -288,6 +292,10 @@ commands:
         limit: { type: number, description: "Max results (default 100)." }
       required: [created_from]
     outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: id
+      incremental_field: created_from
   - id: update_alerts_verdict
     name: sentinelone-update-alerts-verdict
     description: "Set the analyst verdict on one or more cloud-detection alerts."
@@ -965,3 +973,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_threats
+  mapper: get_threats
+  default_incident_type: "SentinelOne Threat"