An endpoint alert tells you that something was detected. It does not always tell you what the sample would have done next. For XDR teams, that missing behavioral context can slow prioritization, investigation, and response.
In this webinar, Andrey Voitenko explains how VMRay integrates with SentinelOne to add that deeper layer of analysis. The workflow automatically retrieves files associated with SentinelOne threats, analyzes them in VMRay, and returns behavior-based enrichment to the SentinelOne incident. Analysts stay in the console they already use while gaining a clearer view of what the file is, why it is malicious, and which indicators matter.
XDR Needs Broad Context and Deep Context
XDR platforms are designed to correlate signals across the environment. A single endpoint detection can be enriched with identity data, SIEM logs, network activity, email or web gateway events, and threat intelligence. This gives analysts broad context: who was involved, what systems were touched, and which related events occurred.
But one question can remain unanswered: what would the suspicious file have done if execution had continued? It may have contacted command-and-control infrastructure, downloaded another payload, changed security settings, stolen credentials, or moved laterally. Dynamic malware analysis adds this deep context by observing the sample's behavior in a controlled environment.
Key point: Correlation explains the surrounding incident. Behavioral analysis explains the threat itself. Mature XDR workflows benefit from both.
For teams focused on EDR and XDR alert enrichment, the value is operational: richer evidence can improve prioritization without forcing analysts into a separate manual investigation path.
What Makes a Sandbox Reliable for XDR Enrichment?
A sandbox only helps automation when its output can be trusted. The webinar highlights three practical requirements: resistance to evasion, low-noise results, and integration that does not add unnecessary analyst work.
Evasion resistance
Modern malware actively checks whether it is running in an analysis environment. A sandbox must minimize detectable artifacts and provide a realistic execution environment so evasive samples continue to reveal their behavior.
Noise-free intelligence
More indicators are not automatically better. Useful enrichment separates sample-driven malicious behavior from normal operating-system activity so analysts do not act on irrelevant IPs, domains, or processes.
Low false-positive risk
Automation depends on confidence. Evaluating benign files matters as much as testing known malware because false positives consume analyst time and can make automated response unsafe.
Workflow fit
Enrichment should arrive where the analyst is already working. If every alert requires a console change and manual resubmission, the integration adds friction instead of removing it.
VMRay addresses these requirements with a hypervisor-based analysis architecture and VMRay Threat Identifiers (VTIs), behavior markers that explain the actions observed during execution. The approach is designed to capture malware behavior while reducing interference from unrelated operating-system activity.
How the VMRay + SentinelOne Integration Works
The integrated connector automates the exchange between both platforms. After configuration, VMRay periodically checks SentinelOne for newly detected threats, retrieves associated files, performs dynamic analysis, and sends the resulting enrichment back to SentinelOne.
Detect: SentinelOne identifies a threat or suspicious file in the endpoint environment.
Submit: The VMRay connector retrieves the associated sample based on the configured submission criteria.
Analyze: VMRay executes the file in its analysis environment and records behavior, classifications, indicators, and configuration data where available.
Enrich: The resulting intelligence is written back into the SentinelOne incident as notes, giving the analyst additional evidence without a manual handoff.
The connector can be configured to submit malicious samples only, malicious and suspicious samples, or a broader set depending on the organization's validation and enrichment use case. The webinar shows a default polling interval of ten minutes, with the option to adjust the interval and set a daily submission limit.
For a product-level walkthrough, see the VMRay + SentinelOne integration page and the SentinelOne threat intelligence enrichment overview.
What Analysts See Inside SentinelOne
The integration is designed to return decision-ready context, not another long report to read. In the webinar demo, VMRay enrichment appears in the SentinelOne incident notes and includes four main categories of information.
Verdict
A clear assessment of whether the analyzed file is malicious or benign, giving the analyst an additional behavior-based decision point.
Threat name and classification
Family names and classifications add context beyond the initial endpoint detection and help distinguish, for example, spyware from other malware types.
VMRay Threat Identifiers
VTIs describe the observed behaviors that contributed to the verdict, helping analysts understand why the sample was classified as malicious.
Indicators of compromise
Hashes, network indicators, downloaded artifacts, and indicators extracted from malware configuration data can be returned for investigation and correlation.
The demo uses an Agent Tesla sample to show how behavior markers can reveal credential-access activity, browser and mail data collection, and attempts to modify Windows Defender exclusions. When malware configuration is available, VMRay can also extract configuration-derived intelligence that strengthens classification and investigation.
Why this matters: An analyst can move from “this endpoint blocked a file” to “this sample behaves like an information stealer, attempted these actions, and exposed these indicators” without leaving the SentinelOne workflow.
Automation Depends on Analysis You Can Trust
The webinar makes an important distinction: sandbox detection quality should not be judged only by whether malicious files are caught. Benign files matter too. If a sandbox routinely produces irrelevant indicators or false positives, those errors propagate into triage queues, blocklists, and response workflows.
That is why the integration focuses on behavior-based evidence and filtered intelligence. The goal is not to maximize output. It is to return the evidence that helps analysts make a decision, then make that evidence available to the broader XDR process for correlation and response.
VMRay's integrated SentinelOne connector was introduced to reduce the hosting, installation, maintenance, and troubleshooting associated with middleware-based integrations. You can read more about the integrated connector in the VMRay Platform 2024.3.0 release highlights.
Key Takeaways
1. Correlation is only part of the picture. XDR provides broad incident context; sandbox analysis adds deep behavioral context about what the file itself attempted to do.
2. Sandbox quality determines automation quality. Evasion resistance, low false positives, and filtered indicators are essential when enrichment feeds automated workflows.
3. The integration removes manual handoffs. SentinelOne threats can be submitted automatically to VMRay, with analysis results written back into the incident.
4. Analysts get evidence, not just another alert. Verdicts, classifications, VTIs, and IOCs explain what was observed and why it matters.
Meet the Presenter
Andrey Voitenko
Sr. Security Product Manager, VMRay | Andrey is the Senior Product Manager at VMRay. Andrey has over 20+ years of experience in Software Security and spent 15+ years with a leading International Software Vendor. He has over 15+ years in product development and promotion on his clock and knows the dark and the bright sides of the EDR and SOAR spaces
Add Behavior-Based Enrichment to SentinelOne
See how VMRay can automate malware analysis and return verdicts, behaviors, and IOCs directly to your existing EDR/XDR workflow.
Try VMRay Watch the Webinar