Having recently completed a quarterly review of our SentinelOne deployment, I found myself dissatisfied with the high-level license consumption metrics provided in the Singularity Console. While the dashboard offers a snapshot, it lacks the granularity and predictive capability required for precise financial forecasting and proactive capacity planning in a large enterprise environment. To address this, I developed a Python-based solution that extracts, analyzes, and projects our endpoint license utilization.
The script leverages the SentinelOne API to gather time-series data on protected agents, broken down by site and agent status. Its core functions are threefold:
* **Historical Analysis:** It constructs a daily trend of active, decommissioned, and inactive agents over a configurable period (I typically use 90 days). This reveals patterns related to onboarding, offboarding, and potential zombie agents that consume licenses.
* **Real-Time Inventory:** It generates a current-state report cross-referencing licensed seats against deployed agents, highlighting immediate overages or underutilization.
* **Forecasting:** Using a simple linear regression model (via scikit-learn), it projects license consumption 30, 60, and 90 days into the future based on the historical trend. This is crucial for aligning renewal discussions with actual growth trajectories.
The implementation requires the `requests`, `pandas`, and `scikit-learn` libraries. Authentication is handled via a Site Manager API token with read-only privileges, stored securely outside the script. The primary workflow involves polling the `/agents` and `/sites` endpoints, filtering the JSON responses, and transforming the data into a structured DataFrame. The forecasting module then fits a model to the daily count of active agents. While not accounting for sudden, large-scale acquisitions, this method has proven to be within a 5% margin of error for our organic growth, which is sufficient for our budgeting cycles.
Key insights this has provided us include identifying a consistent 8% monthly growth in protected servers, a static pool of approximately 3% of agents that were decommissioned but not uninstalled, and a clear seasonal dip in workstation counts during holiday periods. This data was instrumental in our last negotiation, allowing us to transition to a true-up model with confidence. I am considering enhancing the script to integrate with our CMDB for an even more accurate device-type breakdown and to feed data into our Grafana dashboards for broader team visibility.
I am keen to hear from others who have tackled similar observability gaps within their EDR platforms. What metrics do you find most critical for license management? Has anyone attempted to correlate this usage data with threat activity metrics to derive a cost-per-incident or efficacy score?