SentinelOne V2

Use the SentinelOne integration to send requests to your management server and get responses with data pulled from agents or from the management database.

Endpoint · SentinelOne

Details

ID	`SentinelOne V2`
Provider	SentinelOne
Category	Endpoint
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use the SentinelOne integration to send requests to your management server and get responses with data pulled from agents or from the management database.
This integration was integrated and tested with versions 2.0 and 2.1 of SentinelOne V2

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure SentinelOne v2 in Cortex

Parameter	Description	Required
Server URL (e.g., https://usea1.sentinelone.net)		True
API Token		False
API Version		True
Fetch incidents		False
Incident type		False
Fetch incidents from type		False
Fetch incidents from UAM Alert type		False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)		False
Minimum risk score for importing incidents (0-10), where 0 is low risk and 10 is high risk. Relevant for API version 2.0.		False
Defines Alert severity to fetch. Supported values: Low, Medium, High, Critical.		False
Define which Alerts should be fetched.		False
Define which Threats should be fetched.		False
Fetch limit: The maximum number of threats or alerts to fetch		False
Site IDs	Comma-separated list of site IDs to fetch incidents for. Leave blank to fetch all sites.	False
Block Site IDs	Comma-separated list of site IDs for where hashes should be blocked. If left blank all hashes will be blocked globally. If filled out with site ids all hashes will be no longer be blocked globally, they will now be blocked in the scope of those sites.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Incidents Fetch Interval		False
Incident Mirroring Direction	Choose the direction to mirror the incident: Incoming (from SentinelOne to Cortex XSOAR), Outgoing (from Cortex XSOAR to SentinelOne), or Incoming and Outgoing (from/to Cortex XSOAR and SentinelOne). Cortex XSOAR only parameter.	False
Close Mirrored XSOAR Incident	When selected, closing the SentinelOne ticket is mirrored in Cortex XSOAR.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

sentinelone-list-agents

Returns all agents that match the specified criteria.

Base Command

sentinelone-list-agents

Input

Argument Name	Description	Required
computer_name	The computer name by which to filter the results. It can match a partial computer name value (substring).	Optional
scan_status	A comma-separated list of scan statuses by which to filter the results, for example: “started,aborted”. Possible values are: started, none, finished, aborted.	Optional
os_type	Included operating system types, for example: “windows”. Possible values are: windows, windows_legacy, macos, linux.	Optional
created_at	Endpoint creation timestamp, for example: “2018-02-27T04:49:26.257525Z”.	Optional
min_active_threats	Minimum number of threats per agent.	Optional
limit	The maximum number of agents to return. Default is 10.	Optional
params	Query params field=value pairs delimited by comma (e.g., activeThreats=3,gatewayIp=1.2.3.4). Query params are OR’d.	Optional
columns	A comma-separated list of additionals fields to display.	Optional

Context Output

Path	Type	Description
SentinelOne.Agents.NetworkStatus	string	The agent network status.
SentinelOne.Agents.ID	string	The agent ID.
SentinelOne.Agents.AgentVersion	string	The agent software version.
SentinelOne.Agents.IsDecommissioned	boolean	Whether the agent is decommissioned.
SentinelOne.Agents.IsActive	boolean	Whether the agent is active.
SentinelOne.Agents.LastActiveDate	date	When was the agent last active.
SentinelOne.Agents.RegisteredAt	date	The registration date of the agent.
SentinelOne.Agents.ExternalIP	string	The agent IP address.
SentinelOne.Agents.ThreatCount	number	Number of active threats.
SentinelOne.Agents.EncryptedApplications	boolean	Whether disk encryption is enabled.
SentinelOne.Agents.OSName	string	Name of operating system.
SentinelOne.Agents.ComputerName	string	Name of agent computer.
SentinelOne.Agents.MachineType	string	Machine type.
SentinelOne.Agents.Domain	string	Domain name of the agent.
SentinelOne.Agents.CreatedAt	date	Creation time of the agent.
SentinelOne.Agents.SiteName	string	Site name associated with the agent.
SentinelOne.Agents.Tags	unknown	Tags associated with the agent.

sentinelone-create-white-list-item

Creates an exclusion item that matches the specified input filter.

Base Command

sentinelone-create-white-list-item

Input

Argument Name	Description	Required
exclusion_type	Exclusion item type. Possible values are: file_type, path, white_hash, certificate, browser.	Required
exclusion_value	Value of the exclusion item for the exclusion list.	Required
os_type	Operating system type. Required for hash exclusions. Possible values are: windows, windows_legacy, macos, linux.	Required
description	Description for adding the exclusion item.	Optional
exclusion_mode	Exclusion mode (path exclusion only). Possible values are: suppress, disable_in_process_monitor_deep, disable_in_process_monitor, disable_all_monitors, disable_all_monitors_deep.	Optional
path_exclusion_type	Excluded path for a path exclusion list.	Optional
group_ids	A comma-separated list of group IDs by which to filter.	Optional
site_ids	A comma-separated list of site IDs by which to filter.	Optional

Context Output

Path	Type	Description
SentinelOne.Exclusions.ID	string	The entity ID on the allow list.
SentinelOne.Exclusions.Type	string	The item type on the allow list.
SentinelOne.Exclusions.CreatedAt	date	Time when the allow list item was created.

sentinelone-get-white-list

Lists all exclusion items that match the specified input filter.

Base Command

sentinelone-get-white-list

Input

Argument Name	Description	Required
item_ids	List of IDs by which to filter, for example: “225494730938493804,225494730938493915”.	Optional
os_types	A comma-separated list of operating system types by which to filter, for example: “windows, linux”. Possible values are: windows, windows_legacy, macos, linux.	Optional
exclusion_type	Exclusion type. Possible values are: file_type, path, white_hash, certificate, browser.	Optional
limit	The maximum number of items to return. Default is 10.	Optional
include_parent	Whether to include parent information of each item. Default value is false. Default is false.	Optional
include_children	Whether to include children information of each item. Default value is false. Default is false.	Optional

Context Output

Path	Type	Description
SentinelOne.Exclusions.ID	string	The exclusion item ID.
SentinelOne.Exclusions.Type	string	The exclusion item type.
SentinelOne.Exclusions.CreatedAt	date	Timestamp when the exclusion item was added.
SentinelOne.Exclusions.Value	string	Value of the exclusion item.
SentinelOne.Exclusions.Source	string	Source of the exclusion item.
SentinelOne.Exclusions.UserID	string	User ID of the user qho added the exclusion item.
SentinelOne.Exclusions.UpdatedAt	date	Timestamp when the exclusion item was updated.
SentinelOne.Exclusions.OsType	string	Operating system type of the exclusion item.
SentinelOne.Exclusions.UserName	string	User name of the user who added the exclusion item.
SentinelOne.Exclusions.Mode	string	A comma-separated list of modes by which to filter (path exclusions only), for example: “suppress”.

sentinelone-get-hash

Gets the file reputation verdict by a SHA1 hash.

Base Command

sentinelone-get-hash

Input

Argument Name	Description	Required
hash	The content hash.	Required

Context Output

Path	Type	Description
SentinelOne.Hash.Rank	Number	The hash reputation (1-10).
SentinelOne.Hash.Verdict	String	The hash reputation verdict.
SentinelOne.Hash.Hash	String	The content hash.

sentinelone-get-threats

Returns threats according to the specified filters.

Base Command

sentinelone-get-threats

Input

Argument Name	Description	Required
content_hash	A comma-separated list of content hashes of the threat.	Optional
mitigation_status	A comma-separated list of mitigation statuses. Possible values are: mitigated, active, blocked, suspicious, pending, suspicious_resolved.	Optional
created_before	Searches for threats created before this timestamp, for example: “2018-02-27T04:49:26.257525Z”, “10 days”, “5 months”, “2 hours”.	Optional
created_after	Searches for threats created after this timestamp, for example: “2018-02-27T04:49:26.257525Z”, “10 days”, “5 months”, “2 hours”.	Optional
created_until	Searches for threats created on or before this timestamp, for example: “2018-02-27T04:49:26.257525Z”, “10 days”, “5 months”, “2 hours”.	Optional
created_from	Search for threats created on or after this timestamp, for example: “2018-02-27T04:49:26.257525Z”, “10 days”, “5 months”, “2 hours”.	Optional
resolved	Whether to only return resolved threats. Possible values are: false, true. Default is false.	Optional
display_name	Threat display name. For API version 2.0 it can be a partial display name, doesn’t have to be an exact match.	Optional
limit	The maximum number of threats to return. Default is 20.	Optional
query	Full free-text search for fields. Can be “content_hash”, “file_display_name”, “file_path”, “computer_name”, or “uuid”.	Optional
threat_ids	A comma-separated list of threat IDs, for example: “225494730938493804,225494730938493915”.	Optional
classifications	A comma-separated list of threat classifications to search, for example: “Malware”, “Network”, “Benign”. Possible values are: Engine, Static, Cloud, Behavioral.	Optional
rank	Risk level threshold to retrieve (1-10). Relevant for API version 2.0 only.	Optional
site_ids	A comma-separated list of site IDs to search for threats, for example: “225494730938493804,225494730938493915”.	Optional
incident_statuses	Incident status. Example: “IN_PROGRESS, UNRESOLVED”.	Optional
include_resolved_param	Whether to include the resolved parameter in the query. Possible values are: false, true. Default is false.	Optional

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.AgentComputerName	String	The agent computer name.
SentinelOne.Threat.CreatedDate	Date	The threat creation date.
SentinelOne.Threat.SiteID	String	The site ID.
SentinelOne.Threat.Classification	string	The threat classification.
SentinelOne.Threat.ClassificationSource	string	Source of the threat classification.
SentinelOne.Threat.ConfidenceLevel	string	SentinelOne threat confidence level.
SentinelOne.Threat.FileSha256	string	SHA256 hash of the file content.
SentinelOne.Threat.MitigationStatus	String	The agent mitigation status.
SentinelOne.Threat.AgentID	String	The threat agent ID.
SentinelOne.Threat.Rank	Number	The number representing the cloud reputation (1-10).
SentinelOne.Threat.MarkedAsBenign	Boolean	Whether the threat is marked as benign. Relevant for version 2.0 only.

sentinelone-threat-summary

Returns a dashboard threat summary. Can only be used with API V2.1.

Base Command

sentinelone-threat-summary

Input

Argument Name	Description	Required
group_ids	A comma-separated list of group IDs by which to filter, for example: “225494730938493804,225494730938493915”.	Optional

Context Output

Path	Type	Description
SentinelOne.Threat.NotResolved	Number	Number of unresolved threats in the system.
SentinelOne.Threat.SuspiciousNotMitigatedNotResolved	Number	Number of unmitigated suspicious threats in the system.
SentinelOne.Threat.SuspiciousNotResolved	Number	Number of unresolved suspicious threats in the system.
SentinelOne.Threat.Resolved	Number	Number of resolved threats in the system.
SentinelOne.Threat.InProgress	Number	Number of active threats in the system.
SentinelOne.Threat.Total	Number	Total number of threats in the system.
SentinelOne.Threat.NotMitigated	Number	Number of unmitigated threats in the system.
SentinelOne.Threat.MaliciousNotResolved	Number	Number of unresolved malicious threats in the system.
SentinelOne.Threat.NotMitigatedNotResolved	Number	Number of unmitigated and unresolved threats in the system.

sentinelone-mark-as-threat

Marks suspicious threats as threats. Can only be used with API V2.0.

Base Command

sentinelone-mark-as-threat

Input

Argument Name	Description	Required
threat_ids	A comma-separated list of threat IDs.	Optional
target_scope	Scope to use for exclusions. Possible values are: site, tenant.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.MarkedAsThreat	Boolean	Whether the suspicious threat was successfully marked as a threat.

sentinelone-mitigate-threat

Applies a mitigation action to a group of threats that match the specified input filter.

Base Command

sentinelone-mitigate-threat

Input

Argument Name	Description	Required
action	Mitigation action. Possible values are: kill, quarantine, un-quarantine, remediate, rollback-remediation.	Required
threat_ids	A comma-separated list of threat IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Mitigated	Boolean	Whether the threat was successfully mitigated.
SentinelOne.Threat.Mitigation.Action	String	The mitigation action performed.

sentinelone-resolve-threat

Resolves threats using the threat ID. Can only be used with API V2.0.

Base Command

sentinelone-resolve-threat

Input

Argument Name	Description	Required
threat_ids	A comma-separated list of threat IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Resolved	Boolean	Whether the threat was successfully resolved.

sentinelone-get-agent

Returns the details of an agent according to the agent ID.

Base Command

sentinelone-get-agent

Input

Argument Name	Description	Required
agent_id	A comma-separated string of agent IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Agent.NetworkStatus	string	The agent network status.
SentinelOne.Agent.ID	string	The agent ID.
SentinelOne.Agent.AgentVersion	string	The agent software version.
SentinelOne.Agent.IsDecommissioned	boolean	Whether the agent is decommissioned.
SentinelOne.Agent.IsActive	boolean	Whether the agent is active.
SentinelOne.Agent.LastActiveDate	date	When was the agent last active.
SentinelOne.Agent.RegisteredAt	date	The registration date of the agent.
SentinelOne.Agent.ExternalIP	string	The agent IP address.
SentinelOne.Agent.ThreatCount	number	Number of active threats.
SentinelOne.Agent.EncryptedApplications	boolean	Whether disk encryption is enabled.
SentinelOne.Agent.OSName	string	Name of the operating system.
SentinelOne.Agent.ComputerName	string	Name of the agent computer.
SentinelOne.Agent.MachineType	string	Machine type.
SentinelOne.Agent.Domain	string	Domain name of the agent.
SentinelOne.Agent.CreatedAt	date	Agent creation time.
SentinelOne.Agent.SiteName	string	Site name associated with the agent.

sentinelone-get-sites

Returns all sites that match the specified criteria.

Base Command

sentinelone-get-sites

Input

Argument Name	Description	Required
updated_at	Timestamp of the last update, for example: “2018-02-27T04:49:26.257525Z”.	Optional
query	Full-text search for fields: name, account_name.	Optional
site_type	Site type. Possible values are: Trial, Paid, POC, DEV, NFR.	Optional
features	Returns sites that support the specified features. Possible values are: firewall-control, device-control, ioc.	Optional
state	Site state. Possible values are: active, deleted, expired.	Optional
suite	The suite of product features active for this site. Possible values are: Core, Complete.	Optional
admin_only	Sites for which the user has admin privileges. Possible values are: true, false.	Optional
account_id	Account ID, for example: “225494730938493804”.	Optional
site_name	Site name, for example: “My Site”.	Optional
created_at	Timestamp of the site creation, for example: “2018-02-27T04:49:26.257525Z”.	Optional
limit	Maximum number of results to return. Default is 50.	Optional

Context Output

Path	Type	Description
SentinelOne.Site.Creator	string	The site creator name.
SentinelOne.Site.Name	string	The site name.
SentinelOne.Site.Type	string	The site type.
SentinelOne.Site.AccountName	string	The site account name.
SentinelOne.Site.State	string	The site state.
SentinelOne.Site.HealthStatus	boolean	The health status of the site.
SentinelOne.Site.Suite	string	The suite to which the site belongs.
SentinelOne.Site.ActiveLicenses	number	Number of active licenses for the site.
SentinelOne.Site.ID	string	ID of the site.
SentinelOne.Site.TotalLicenses	number	Number of total licenses for the site.
SentinelOne.Site.CreatedAt	date	Timestamp when the site was created.
SentinelOne.Site.Expiration	string	Timestamp when the site will expire.
SentinelOne.Site.UnlimitedLicenses	boolean	Whether the site has unlimited licenses.

sentinelone-get-site

Returns information about the site, according to the site ID.

Base Command

sentinelone-get-site

Input

Argument Name	Description	Required
site_id	ID of the site.	Required

Context Output

Path	Type	Description
SentinelOne.Site.Creator	string	The site creator name.
SentinelOne.Site.Name	string	The site name.
SentinelOne.Site.Type	string	The site type.
SentinelOne.Site.AccountName	string	The site account name.
SentinelOne.Site.State	string	The site state.
SentinelOne.Site.HealthStatus	boolean	The health status of the site.
SentinelOne.Site.Suite	string	The suite to which the site belongs.
SentinelOne.Site.ActiveLicenses	number	Number of active licenses for the site.
SentinelOne.Site.ID	string	ID of the site.
SentinelOne.Site.TotalLicenses	number	Number of total licenses for the site.
SentinelOne.Site.CreatedAt	date	Timestamp when the site was created.
SentinelOne.Site.Expiration	string	Timestamp when the site will expire.
SentinelOne.Site.UnlimitedLicenses	boolean	Whether the site has unlimited licenses.
SentinelOne.Site.AccountID	string	Site account ID.
SentinelOne.Site.IsDefault	boolean	Whether the site is the default site.

sentinelone-reactivate-site

Reactivates an expired site.

Base Command

sentinelone-reactivate-site

Input

Argument Name	Description	Required
site_id	Site ID. For example: “225494730938493804”.	Required
unlimited	If false, an expiration should be supplied.	Optional
expiration	Expiration date in case unlimited is false, for example, “2019-08-03T04:49:26.257525Z”.	Optional

Context Output

Path	Type	Description
SentinelOne.Site.ID	string	Site ID.
SentinelOne.Site.Reactivated	boolean	Whether the site was reactivated.

sentinelone-get-activities

Returns a list of activities.

Base Command

sentinelone-get-activities

Input

Argument Name	Description	Required
created_after	Return activities created after this timestamp, for example: “2018-02-27T04:49:26.257525Z”.	Optional
user_emails	Email address of the user who invoked the activity (if applicable).	Optional
group_ids	List of group IDs by which to filter, for example: “225494730938493804,225494730938493915”.	Optional
created_until	Return activities created on or before this timestamp, for example: “2018-02-27T04:49:26.257525Z”.	Optional
include_hidden	Include internal activities hidden from display. Possible values are: true, false.	Optional
activities_ids	A comma-separated list of activity IDs by which to filter, for example: “225494730938493804,225494730938493915”.	Optional
created_before	Return activities created before this timestamp, for example: “2018-02-27T04:49:26.257525Z”.	Optional
threats_ids	A comma-separated list of threat IDs for which to return activities, for example: “225494730938493804,225494730938493915”.	Optional
activity_types	A comma-separated list of activity codes to return, for example: “52,53,71,72”.	Optional
user_ids	A comma-separated list of user IDs for users that invoked the activity (if applicable), for example: “225494730938493804,225494730938493915”.	Optional
created_from	Return activities created on or after this timestamp, for example: “2018-02-27T04:49:26.257525Z”.	Optional
created_between	Return activities created within this range (inclusive), for example: “1514978764288-1514978999999”.	Optional
agent_ids	Return activities related to specified agents. For example: “225494730938493804,225494730938493915”.	Optional
limit	Maximum number of items to return (1-100).	Optional
sort_by	Field to sort results by. Possible values are: activityType, createdAt, id.	Optional
sort_order	Order to sort by. Possible values are: asc, desc.	Optional

Context Output

Path	Type	Description
SentinelOne.Activity.AgentID	String	Related agent (if applicable).
SentinelOne.Activity.AgentUpdatedVersion	String	Agent’s new version (if applicable).
SentinelOne.Activity.SiteID	String	Related site (if applicable).
SentinelOne.Activity.UserID	String	The user who invoked the activity (if applicable).
SentinelOne.Activity.SecondaryDescription	String	Secondary description.
SentinelOne.Activity.OsFamily	String	Agent’s operating system type (if applicable). Can be “linux”, “macos”, “windows”, or “windows_legacy”.
SentinelOne.Activity.ActivityType	Number	Activity type.
SentinelOne.Activity.data.SiteID	String	The site ID.
SentinelOne.Activity.data.SiteName	String	The site name.
SentinelOne.Activity.data.username	String	The name of the site creator.
SentinelOne.Activity.Hash	String	Threat file hash (if applicable).
SentinelOne.Activity.UpdatedAt	Date	Activity last updated time (UTC).
SentinelOne.Activity.Comments	String	Comments for the activity.
SentinelOne.Activity.ThreatID	String	Related threat (if applicable).
SentinelOne.Activity.PrimaryDescription	String	Primary description for the activity.
SentinelOne.Activity.GroupID	String	Related group (if applicable).
SentinelOne.Activity.ID	String	Activity ID.
SentinelOne.Activity.CreatedAt	Date	Activity creation time (UTC).
SentinelOne.Activity.Description	String	Extra activity information.

sentinelone-get-groups

Returns data for the specified group.

Base Command

sentinelone-get-groups

Input

Argument Name	Description	Required
group_type	Group type, for example: “static”.	Optional
group_ids	A comma-separated list of group IDs by which to filter, for example: “225494730938493804,225494730938493915”.	Optional
group_id	Group ID by which to filter, for example: “225494730938493804”.	Optional
is_default	Whether this is the default group. Possible values are: true, false.	Optional
name	The name of the group.	Optional
query	Free-text search.	Optional
rank	The priority of a dynamic group over others, for example, “1”, which is the highest priority.	Optional
limit	Maximum number of items to return (1-200).	Optional

Context Output

Path	Type	Description
SentinelOne.Group.siteId	String	The ID of the site of which this group is a member.
SentinelOne.Group.filterName	String	If the group is dynamic, the name of the filter which is used to associate agents.
SentinelOne.Group.creatorId	String	The ID of the user who created the group.
SentinelOne.Group.name	String	The name of the group.
SentinelOne.Group.creator	String	The user who created the group.
SentinelOne.Group.rank	Number	The rank, which sets the priority of a dynamic group over others.
SentinelOne.Group.updatedAt	Date	Timestamp of the last update.
SentinelOne.Group.totalAgents	Number	Number of agents in the group.
SentinelOne.Group.filterId	String	If the group is dynamic, the group ID of the filter that is used to associate agents.
SentinelOne.Group.isDefault	Boolean	Whether the groups is the default group of the site.
SentinelOne.Group.inherits	Boolean	Whether the policy is inherited from a site. “False” if the group has its own edited policy.
SentinelOne.Group.type	String	Group type. Can be static or dynamic
SentinelOne.Group.id	String	The ID of the group.
SentinelOne.Group.createdAt	Date	Timestamp of group creation.

sentinelone-move-agent

Moves agents to a new group.

Base Command

sentinelone-move-agent

Input

Argument Name	Description	Required
group_id	The ID of the group to move the agent to.	Required
agents_ids	Agents IDs.	Optional

Context Output

Path	Type	Description
SentinelOne.Agent.AgentsMoved	Number	The number of agents that were moved to another group.

sentinelone-delete-group

Deletes a group, by the group ID.

Base Command

sentinelone-delete-group

Input

Argument Name	Description	Required
group_id	The ID of the group to delete.	Required

Context Output

Path	Type	Description
SentinelOne.DeleteGroup.Success	String	The status of the command.

sentinelone-connect-agent

Connects agents to the network.

Base Command

sentinelone-connect-agent

Input

Argument Name	Description	Required
agent_id	A comma-separated list of agent IDs to connect to the network. Run the list-agents command to get a list of agent IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Agent.AgentsAffected	Number	The number of affected agents.
SentinelOne.Agent.NetworkStatus	String	Agent network status.
SentinelOne.Agent.ID	String	Input agents’ IDs.

sentinelone-disconnect-agent

Disconnects agents from the network.

Base Command

sentinelone-disconnect-agent

Input

Argument Name	Description	Required
agent_id	A comma-separated list of agent IDs to disconnect from the network. Run the list-agents command to get a list of agent IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Agent.NetworkStatus	String	Agent network status.
SentinelOne.Agent.ID	String	Input agents’ IDs.

sentinelone-broadcast-message

Broadcasts a message to all agents that match the input filters.

Base Command

sentinelone-broadcast-message

Input

Argument Name	Description	Required
message	The message to broadcast to agents.	Required
active_agent	Whether to only include active agents. Default is “false”. Possible values are: true, false.	Optional
group_id	A comma-separated list of group IDs by which to filter the results.	Optional
agent_id	A comma-separated list of agent IDs by which to filter the results.	Optional
domain	A comma-separated of included network domains.	Optional

Context Output

Path	Type	Description
SentinelOne.BroadcastMessage.Affected	String	Number of affected endpoints.

sentinelone-get-events

Returns all Deep Visibility events that match the query.

Base Command

sentinelone-get-events

Input

Argument Name	Description	Required
limit	Maximum number of items to return (1-100). Default is 50.	Optional
query_id	QueryId obtained when creating a query in the sentinelone-create-query command. Example: “q1xx2xx3”.	Required
cursor	Cursor pointer to get next page of results from query.	Optional
columns	A comma-separated list of additionals fields to display.	Optional

Context Output

Path	Type	Description
SentinelOne.Event.ProcessUID	String	Process unique identifier.
SentinelOne.Event.SHA256	String	SHA256 hash of the file.
SentinelOne.Event.AgentOS	String	Operating system type. Can be “windows”, “linux”, “macos”, or “windows_legac”.
SentinelOne.Event.ProcessID	Number	The process ID.
SentinelOne.Event.User	String	User assigned to the event.
SentinelOne.Event.Time	Date	Process start time.
SentinelOne.Event.Endpoint	String	The agent name.
SentinelOne.Event.SiteName	String	Site name.
SentinelOne.Event.EventType	String	Event type. Can be “events”, “file”, “ip”, “url”, “dns”, “process”, “registry”, “scheduled_task”, or “logins”.
SentinelOne.Event.ProcessName	String	The name of the process.
SentinelOne.Event.MD5	String	MD5 hash of the file.
SentinelOne.Event.SourceIP	String	The source ip.
SentinelOne.Event.SourcePort	String	The source port.
SentinelOne.Event.DestinationIP	String	The destination IP.
SentinelOne.Event.DestinationPort	String	The destination port.
SentinelOne.Event.SourceProcessUser	String	The source process user.
SentinelOne.Event.SourceProcessCommandLine	String	The source process command line.
SentinelOne.Event.DNSRequest	String	The DNS Request.
SentinelOne.Event.FileFullName	String	The file full name.
SentinelOne.Event.EventTime	String	The event time.
Event.ID	String	Event process ID.
Event.Name	String	Event name.
Event.Type	String	Event type.
SentinelOne.Cursor.Event	String	cursor to recieve next page

sentinelone-create-query

Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.

Base Command

sentinelone-create-query

Input

Argument Name	Description	Required
query	The query string for which to return events.	Required
from_date	Query start date, for example, “2019-08-03T04:49:26.257525Z”. Limited to 93 days ago.	Required
to_date	Query end date, for example, “2019-08-03T04:49:26.257525Z”.	Required

Context Output

Path	Type	Description
SentinelOne.Query.FromDate	Date	Query start date.
SentinelOne.Query.Query	String	The search query string.
SentinelOne.Query.QueryID	String	The query ID.
SentinelOne.Query.ToDate	Date	Query end date.

sentinelone-get-processes

Returns a list of Deep Visibility events from query by event type - process.

Base Command

sentinelone-get-processes

Input

Argument Name	Description	Required
query_id	The queryId that is returned when creating a query under Create Query. Example: “q1xx2xx3”. Get the query_id from the “get-query-id” command.	Required
limit	Maximum number of items to return (1-100). Default is 50.	Optional

Context Output

Path	Type	Description
SentinelOne.Event.ParentProcessID	Number	Parent process ID.
SentinelOne.Event.ProcessUID	String	The process unique identifier.
SentinelOne.Event.SHA1	String	SHA1 hash of the process image.
SentinelOne.Event.SubsystemType	String	Process sub-system.
SentinelOne.Event.ParentProcessStartTime	Date	The parent process start time.
SentinelOne.Event.ProcessID	Number	The process ID.
SentinelOne.Event.ParentProcessUID	String	Parent process unique identifier.
SentinelOne.Event.User	String	User assigned to the event.
SentinelOne.Event.Time	Date	Start time of the process.
SentinelOne.Event.ParentProcessName	String	Parent process name.
SentinelOne.Event.SiteName	String	Site name.
SentinelOne.Event.EventType	String	The event type.
SentinelOne.Event.Endpoint	String	The agent name (endpoint).
SentinelOne.Event.IntegrityLevel	String	Process integrity level.
SentinelOne.Event.CMD	String	Process CMD.
SentinelOne.Event.ProcessName	String	Process name.
SentinelOne.Event.ProcessDisplayName	String	Process display name.

sentinelone-shutdown-agent

Sends a shutdown command to all agents that match the input filter.

Base Command

sentinelone-shutdown-agent

Input

Argument Name	Description	Required
query	A free-text search term that will match applicable attributes (sub-string match). Note: A device’s physical addresses will only be matched if they start with the search term (not if they contain the search term).	Optional
agent_id	A comma-separated list of agents IDs to shutdown.	Optional
group_id	The ID of the network group.	Optional

Context Output

Path	Type	Description
SentinelOne.Agent.ID	String	The ID of the agent that was shutdown.

sentinelone-uninstall-agent

Sends an uninstall command to all agents that match the input filter.

Base Command

sentinelone-uninstall-agent

Input

Argument Name	Description	Required
query	A free-text search term that will match applicable attributes (sub-string match). Note: A device’s physical addresses will only be matched if they start with the search term (not if they contain the search term).	Optional
agent_id	A comma-separated list of agents IDs to shutdown.	Optional
group_id	The ID of the network group.	Optional

Context Output

Path	Type	Description
SentinelOne.uninstall.Affected	String	Number of affected agents.

sentinelone-update-threats-verdict

Updates the analyst verdict to a group of threats that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-update-threats-verdict

Input

Argument Name	Description	Required
verdict	Analyst verdict action. Possible values are: undefined, true_positive, false_positive, suspicious.	Required
threat_ids	A comma-separated list of threat IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Updated	Boolean	Whether the threat was successfully updated in the analyst verdict.
SentinelOne.Threat.Update.Action	String	Name of the analyst verdict action performed on the threats.

sentinelone-update-alerts-verdict

Updates the analyst verdict to a group of alerts that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-update-alerts-verdict

Input

Argument Name	Description	Required
verdict	Analyst verdict action. Possible values are: undefined, true_positive, false_positive, suspicious.	Required
alert_ids	A comma-separated list of alert IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Alert.ID	String	The alert ID.
SentinelOne.Alert.Updated	Boolean	Whether the alert was successfully updated in the analyst verdict.
SentinelOne.Alert.Update.Action	String	Name of the analyst verdict action performed on the alerts.

sentinelone-create-star-rule

Creates a custom STAR rule. Relevant for API version 2.1.

Base Command

sentinelone-create-star-rule

Input

Argument Name	Description	Required
name	The name of the STAR rule.	Required
rule_severity	The rule severity. Possible values are: Low, Medium, High, Critical.	Required
expiration_mode	Type of expiration mode. Possible values are: Permanent, Temporary.	Required
query_type	Type of the query. For now it’s “events”. Possible values are: events, processes.	Required
query	The query string for which to return events.	Required
description	The description of the STAR rule.	Optional
expiration_date	If expiration mode is “Temporary” then it should be supplied, for example, “2019-08-03T04:49:26.257525Z” .	Optional
site_ids	A comma-separated list of site IDs.	Optional
group_ids	A comma-separated list of Group IDs.	Optional
account_ids	A comma-separated list of Account IDs.	Optional
network_quarantine	Whether to enable the network quarantine of the STAR rule. Possible values are: true, false.	Required
treatAsThreat	The treatAsThreat type. Possible values are: Malicious, Suspicious, UNDEFINED.	Required
query_lang	The query language version. Supported values are “1.0” and “2.0”.	Optional

Context Output

Path	Type	Description
SentinelOne.StarRule.ID	String	The STAR rule ID.
SentinelOne.StarRule.Name	String	The STAR rule name.
SentinelOne.StarRule.Status	String	The status of the STAR rule.
SentinelOne.StarRule.Severity	String	The severity of the STAR rule.
SentinelOne.StarRule.Description	String	The description of the STAR rule.
SentinelOne.StarRule.NetworkQuarantine	Boolean	The network quarantine of the STAR rule.
SentinelOne.StarRule.TreatAsThreat	String	The Treat As Threat of the STAR rule.
SentinelOne.StarRule.ExpirationMode	String	The expiration mode of the STAR rule.
SentinelOne.StarRule.ExpirationDate	String	The expiration date of the STAR rule.
SentinelOne.StarRule.ScopeHierarchy	String	The scope hierarchy of the STAR rule.
SentinelOne.StarRule.CreatedAt	String	The created time for the STAR rule.
SentinelOne.StarRule.UpdatedAt	String	The updated time for the STAR rule.
SentinelOne.StarRule.QueryLanguage	String	The Query language for the STAR rule.

sentinelone-get-star-rules

Get a list of custom detection rules for a given scope. Relevant for API version 2.1.

Base Command

sentinelone-get-star-rules

Input

Argument Name	Description	Required
status	A comma-separated list of the status of the STAR rule. Available options are: “Activating, Active, Deleted, Deleting, Disabled, Disabling and Draft”.Example: “Draft,Active”.	Optional
creator_contains	Free-text filter by rule creator (supports multiple values). Example: “Service Pack 1”.	Optional
queryType	Return rules with the filtered type. Example: “events”. Possible values are: events, processes.	Optional
query	Free-text filter by S1 query (supports multiple values). Example: “Service Pack 1”.	Optional
description_contains	Free-text filter by rule description (supports multiple values). Example: “Service Pack 1”.	Optional
ruleIds	A comma-separated list of Rules IDs. Example: “225494730938493804,225494730938493915”.	Optional
name_contains	Free-text filter by rule name (supports multiple values). Example: “Service Pack 1”.	Optional
accountIds	A comma-separated list of Account IDs to filter by. Example: “225494730938493804,225494730938493915”.	Optional
expirationMode	Return rules with the filtered expiration mode. Example: “Permanent”. Possible values are: Temporary, Permanent.	Optional
limit	Limit number of returned items (1-1000). Example: “10”.	Optional
siteIds	A comma-separated list of site IDs to filter by. Example: “225494730938493804,225494730938493915”.	Optional

Context Output

Path	Type	Description
SentinelOne.StarRule.ID	Number	The STAR rule ID.
SentinelOne.StarRule.Creator	string	The STAR rule creator.
SentinelOne.StarRule.Name	string	The STAR rule name.
SentinelOne.StarRule.Status	string	The STAR rule status.
SentinelOne.StarRule.Severity	string	The STAR rule severity.
SentinelOne.StarRule.GeneratedAlerts	Number	The number of STAR rule generated alerts.
SentinelOne.StarRule.Description	string	The STAR rule description.
SentinelOne.StarRule.StatusReason	string	The STAR rule status reason.
SentinelOne.StarRule.ExpirationMode	string	The STAR rule expiration mode.
SentinelOne.StarRule.ExpirationDate	Date	The STAR rule expiration date.
SentinelOne.StarRule.Expired	Boolean	Whether the STAR rule expired.

sentinelone-update-star-rule

Updates a custom STAR rule. Relevant for API version 2.1.

Base Command

sentinelone-update-star-rule

Input

Argument Name	Description	Required
rule_id	Rule ID Example: “225494730938493804”.	Required
name	The name of the STAR rule.	Required
rule_severity	The rule severity. Possible values are: Low, Medium, High, Critical.	Required
expiration_mode	Type of expiration mode. Possible values are: Permanent, Temporary.	Required
query_type	Type of the query. For now it’s “events”. Possible values are: events, processes.	Required
query	The query string for which to return events.	Required
description	The description of the STAR rule.	Optional
expiration_date	If expiration mode is “Temporary” then it should be supplied, for example, “2019-08-03T04:49:26.257525Z”.	Optional
site_ids	A comma-separated list of site IDs.	Optional
group_ids	A comma-separated list of group IDs.	Optional
account_ids	A comma-separated list of account IDs.	Optional
network_quarantine	Whether to enable the network quarantine of the STAR rule. Possible values are: true, false.	Required
treatAsThreat	The treatAsThreat. Possible values are: Malicious, Suspicious, UNDEFINED.	Required
query_lang	The query language version. Supported values are “1.0” and “2.0”.	Optional

Context Output

Path	Type	Description
SentinelOne.StarRule.ID	String	The STAR rule ID.
SentinelOne.StarRule.Name	String	The STAR rule name.
SentinelOne.StarRule.Status	String	The status of the STAR rule.
SentinelOne.StarRule.Severity	String	The severity of the STAR rule.
SentinelOne.StarRule.Description	String	The description of the STAR rule.
SentinelOne.StarRule.NetworkQuarantine	Boolean	The network quarantine of the STAR rule.
SentinelOne.StarRule.TreatAsThreat	String	The Treat As Threat of the STAR rule.
SentinelOne.StarRule.ExpirationMode	String	The expiration mode of the STAR rule.
SentinelOne.StarRule.ExpirationDate	String	The expiration date of the STAR rule.
SentinelOne.StarRule.ScopeHierarchy	String	The scope hierarchy of the STAR rule.
SentinelOne.StarRule.CreatedAt	String	The created time for the STAR rule.
SentinelOne.StarRule.UpdatedAt	String	The updated time for the STAR rule.
SentinelOne.StarRule.QueryLanguage	String	The Query language for the STAR rule.

sentinelone-enable-star-rules

Activate Custom Detection rules that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-enable-star-rules

Input

Argument Name	Description	Required
rule_ids	A comma-separated list of STAR rule IDs.	Required

Context Output

Path	Type	Description
SentinelOne.StarRule.ID	String	The Rule ID.
SentinelOne.StarRule.Enabled	Boolean	Whether the STAR rule was successfully enabled.

sentinelone-disable-star-rules

Disable Custom Detection rules that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-disable-star-rules

Input

Argument Name	Description	Required
rule_ids	A comma-separated list of STAR rule IDs.	Required

Context Output

Path	Type	Description
SentinelOne.StarRule.ID	String	The Rule ID.
SentinelOne.StarRule.Disabled	Boolean	Whether the STAR rule was successfully disabled.

sentinelone-delete-star-rule

Deletes Custom Detection Rules that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-delete-star-rule

Input

Argument Name	Description	Required
rule_ids	A comma-separated list of STAR rule IDs.	Required

Context Output

Path	Type	Description
SentinelOne.StarRule.ID	String	The Rule ID.
SentinelOne.StarRule.Deleted	Boolean	Whether the STAR rule was successfully deleted.

sentinelone-get-blocklist

Retrieve the blocklist (“blacklist” in SentinelOne documentation). You can filter by SHA1 or SHA256 hash. If the global flag is true, then group_ids, site_ids, and account_ids are ignored.

Base Command

sentinelone-get-blocklist

Input

Argument Name	Description	Required
global	Whether the global list is accessible. (Same as `tenant` flag in API docs.). Possible values are: true, false. Default is true.	Optional
group_ids	Comma-separated list of group IDs to filter by.	Optional
site_ids	Comma-separated list of site IDs to filter by.	Optional
account_ids	Comma-separated list of account IDs to filter by.	Optional
offset	The number of records to skip (for paging). Default is 0.	Optional
limit	The maximum number of records to return. Default is 1000.	Optional
hash	Hash to search for in the blocklist.	Optional
sha1	SHA1 hash to search for in the blocklist.	Optional
sha256Value	SHA256 hash to search for in the blocklist.	Optional

Context Output

Path	Type	Description
SentinelOne.Blocklist.UserId	String	User ID.
SentinelOne.Blocklist.UpdatedAt	String	When entry was most recently updated.
SentinelOne.Blocklist.Value	String	File hash.
SentinelOne.Blocklist.ScopePath	String	SentinelOne list scope.
SentinelOne.Blocklist.Type	String	Block list type.
SentinelOne.Blocklist.Source	String	Source of entry.
SentinelOne.Blocklist.ID	String	Entry ID.
SentinelOne.Blocklist.CreatedAt	String	Date entry was created.
SentinelOne.Blocklist.Description	String	Description of the blocklist.
SentinelOne.Blocklist.OSType	String	Operating system type block is enforced on.
SentinelOne.Blocklist.ScopeName	String	Name of the blocklist scope.

sentinelone-add-hash-to-blocklist

Add a hash to the blocklist in SentinelOne.
If a scope is provided (site, account, or group), the hash will be added to that specific scope.
If no scope is provided, the hash will be added to the global blocklist.

Base Command

sentinelone-add-hash-to-blocklist

Input

Argument Name	Description	Required
sha1	SHA1 hash to add to the blocklist.	Optional
sha256Value	SHA256 hash to add to the blocklist.	Optional
source	String describing the source of the block. Default is XSOAR.	Optional
os_type	Type of operating system. Possible values are: windows, linux, macos.	Required
description	Note stored in SentinelOne about the block. Default is Blocked from XSOAR.	Optional
site_ids	Comma-separated string of site IDs to add the hash to.	Optional
account_ids	Comma-separated string of account IDs to add the hash to.	Optional
group_ids	Comma-separated string of group IDs to add the hash to.	Optional

Context Output

Path	Type	Description
SentinelOne.AddHashToBlocklist.hash	unknown	Hash of the file.
SentinelOne.AddHashToBlocklist.status	unknown	Status of the action to add a hash to the blocklist.

sentinelone-remove-hash-from-blocklist

Remove a hash from the blocklist in SentinelOne.
If a scope is provided (site, account, or group), the hash will be removed from that specific scope.
If no scope is provided, the hash will be removed from the global blocklist.

Base Command

sentinelone-remove-hash-from-blocklist

Input

Argument Name	Description	Required
sha1	SHA1 hash to remove from the blocklist.	Optional
sha256Value	SHA256 hash to remove from the blocklist.	Optional
os_type	Optional operating system type. If not supplied, will remove the SHA1 hash across all platforms. Possible values are: windows, macos, linux.	Optional
site_ids	Comma-separated string of site IDs to remove the hash from.	Optional
account_ids	Comma-separated string of account IDs to remove the hash from.	Optional
group_ids	Comma-separated string of group IDs to remove the hash from.	Optional

Context Output

Path	Type	Description
SentinelOne.RemoveHashFromBlocklist.hash	unknown	Hash of the file.
SentinelOne.RemoveHashFromBlocklist.status	unknown	Status of the action to remove a hash from the blocklist.

sentinelone-fetch-file

Invokes a fetch files command against an agent endpoint.

Base Command

sentinelone-fetch-file

Input

Argument Name	Description	Required
agent_id	Agent ID to retrieve the file from.	Required
file_path	File path to download the file from.	Required
password	Password to protect the zip file with.	Required

Context Output

There is no context output for this command.

sentinelone-download-fetched-file

Download a file fetched using th sentinelone-fetch-file command to submit the request and the sentinelone-get-activities command to get the download path.

Base Command

sentinelone-download-fetched-file

Input

Argument Name	Description	Required
agent_id	SentinelOne agent ID. Default is Agent ID.	Required
activity_id	Activity ID in the get-activities command.	Required
password	Password used in the sentinelone-fetch-file command.	Required

Context Output

There is no context output for this command.

sentinelone-write-threat-note

Add a threat note to one or more threats. Relevant for API version 2.1.

Base Command

sentinelone-write-threat-note

Input

Argument Name	Description	Required
threat_ids	A comma-separated list of threat IDs.	Required
note	Threat Note Text.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Note	String	The threat note.
SentinelOne.Threat.Status	String	Whether the note was added successfully.

sentinelone-create-ioc

Add an IoC to the Threat Intelligence database. Relevant for API version 2.1.

Base Command

sentinelone-create-ioc

Input

Argument Name	Description	Required
name	Threat Intelligence indicator name.	Required
source	The source of the identified Threat Intelligence indicator.	Required
type	The type of the Threat Intelligence indicator. Possible values are: DNS, IPV4, IPV6, MD5, SHA1, SHA256, URL.	Required
method	The comparison method used by SentinelOne to trigger the event. Possible values are: EQUALS.	Required
validUntil	Expiration date for the Threat Intelligence indicator.	Required
value	The value of the Threat Intelligence indicator.	Required
account_ids	List of account IDs to filter by.	Required
externalId	The unique identifier of the indicator as provided by the Threat Intelligence source.	Optional
description	Description of the Threat Intelligence indicator.	Optional

Context Output

Path	Type	Description
SentinelOne.IOC.UUID	String	The IOC UUID.
SentinelOne.IOC.Name	String	Threat Intelligence indicator name.
SentinelOne.IOC.Source	String	The source of the identified Threat Intelligence indicator.
SentinelOne.IOC.Type	String	The type of the Threat Intelligence indicator.
SentinelOne.IOC.BatchId	String	The IOC batch ID.
SentinelOne.IOC.Creator	String	The IOC creator.
SentinelOne.IOC.Scope	String	The IOC scope.
SentinelOne.IOC.ScopeId	String	The IOC scope ID.
SentinelOne.IOC.ValidUntil	String	Expiration date for the Threat Intelligence indicator.
SentinelOne.IOC.Description	String	Description of the Threat Intelligence indicator.
SentinelOne.IOC.ExternalId	String	The unique identifier of the indicator as provided by the Threat Intelligence source.

sentinelone-delete-ioc

Delete an IOC from the Threat Intelligence database that matches a filter. Relevant for API version 2.1.

Base Command

sentinelone-delete-ioc

Input

Argument Name	Description	Required
account_ids	List of account IDs to filter by.	Required
uuids	UUID of Threat Intelligence indicator.	Required

Context Output

Path	Type	Description
SentinelOne.IOC.UUID	String	The IOC UUID.
SentinelOne.IOC.Deleted	Boolean	Whether the Threat Intelligence indicator was deleted.

sentinelone-get-iocs

Get the IOCs of a specified account that match the filter. Relevant for API version 2.1.

Base Command

sentinelone-get-iocs

Input

Argument Name	Description	Required
account_ids	List of account IDs to filter by.	Required
limit	Limit number of returned items (1-1000). Default is 1000.	Optional
upload_time_gte	The time (greater than or equal to) at which the Threat Intelligence indicator was uploaded to the SentinelOne database. Example: “2022-07-13T20:33:29.007906Z”.	Optional
upload_time_lte	The time (less than or equal to) at which the Threat Intelligence indicator was uploaded to the SentinelOne database. Example: “2022-07-13T20:33:29.007906Z”.	Optional
cursor	Cursor position returned by the last request. Should be used for iterating over more than 1000 items. Example: “YWdlbnRfaWQ6NTgwMjkzODE=”.	Optional
uuids	A list of unique IDs of the parent process of the indicator of compromise. Example: “2cffae871197f20d864fe8363eee6651”.	Optional
type	The type of the Threat Intelligence indicator. Possible values are: DNS, IPV4, IPV6, MD5, SHA1, SHA256, URL.	Optional
batch_id	Unique ID of the uploaded indicators batch. Example: “atmtn000000028a881bcf939dc6d92ab55443”.	Optional
source	List of the sources of the identified Threat Intelligence indicator. Example: “AlienVault”.	Optional
value	The value of the Threat Intelligence indicator. Example: “175.0.x.x”.	Optional
external_id	The unique identifier of the indicator as provided by the Threat Intelligence source. Example: “e277603e-1060-5ad4-9937-c26c97f1ca68”.	Optional
name_contains	A comma-separated list of free-text filtered by the indicator name. Example: “foo.dll”.	Optional
creator_contains	A comma-separated list of free-text filtered by the user who uploaded the Threat Intelligence indicator. Example: “admin@sentinelone.com”.	Optional
description_contains	A comma-separated list of free-text filtered by the description of the indicator. Example: “Malicious-activity”.	Optional
category_in	The categories of the Threat Intelligence indicator. Example: The malware type associated with the IOC.	Optional
updated_at_gte	The time (greater or equal to) at which the indicator was last updated in the SentinelOne database. Example: “2021-07-13T20:33:29.007906Z”.	Optional
updated_at_lte	The time (less than or equal to) at which the indicator was last updated in the SentinelOne database. Example: “2021-07-13T20:33:29.007906Z”.	Optional
creation_time_gte	Creation time (greater than or equal to) as set by the user. Example: “2021-07-13T20:33:29.007906Z”.	Optional
creation_time_lte	Creation time (less than or equal to) as set by the user. Example: “2021-07-13T20:33:29.007906Z”.	Optional

Context Output

Path	Type	Description
SentinelOne.IOC.UUID	String	The IOC UUID.
SentinelOne.IOC.Creator	String	Threat Intelligence indicator creator.
SentinelOne.IOC.Name	String	Threat Intelligence indicator name.
SentinelOne.IOC.Value	String	Threat Intelligence indicator value.
SentinelOne.IOC.Description	String	Threat Intelligence indicator description.
SentinelOne.IOC.Type	String	Threat Intelligence indicator type.
SentinelOne.IOC.ExternalId	String	Threat Intelligence indicator external ID.
SentinelOne.IOC.Source	String	Threat Intelligence indicator source.
SentinelOne.IOC.UploadTime	String	Threat Intelligence indicator upload time.
SentinelOne.IOC.ValidUntil	String	Threat Intelligence indicator expiration time.

sentinelone-create-power-query

Deprecated. Start a Deep Visibility Power query to get back status and potential results (ping afterwards using the queryId if query has not finished). Relevant for API version 2.1

Base Command

sentinelone-create-power-query

Input

Argument Name	Description	Required
query	Events matching the query search term will be returned.	Required
from_date	Events created after this timestamp.	Required
to_date	Events created before or at this timestamp.	Required
limit	Limit number of returned items (1-100000).	Optional

Context Output

There is no context output for this command.

sentinelone-ping-power-query

Deprecated. Ping a Deep Visibility Power query using the queryId argument if results have not returned from an initial Power query or a previous ping. Relevant for API version 2.1.

Base Command

sentinelone-ping-power-query

Input

Argument Name	Description	Required
queryId	QueryId.	Required

Context Output

There is no context output for this command.

sentinelone-update-threats-status

Updates the incident status to a group of threats that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-update-threats-status

Input

Argument Name	Description	Required
status	Incident status. Possible values are: in_progress, resolved, unresolved.	Required
threat_ids	A comma-separated list of threat IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Updated	Boolean	Whether the threat was successfully updated.
SentinelOne.Threat.Status	String	Name of the status performed on the threats.

sentinelone-update-alerts-status

Updates the incident status to a group of alerts that match the specified input filter. Relevant for API version 2.1.

Base Command

sentinelone-update-alerts-status

Input

Argument Name	Description	Required
status	Incident status. Possible values are: in_progress, resolved, unresolved.	Required
alert_ids	A comma-separated list of alert IDs.	Required

Context Output

Path	Type	Description
SentinelOne.Alert.ID	String	The alert ID.
SentinelOne.Alert.Updated	Boolean	Whether the alert was successfully updated.
SentinelOne.Alert.Status	String	The status performed on the alerts.

sentinelone-expire-site

Expire the site of the given ID

Base Command

sentinelone-expire-site

Input

Argument Name	Description	Required
site_id	A valid site ID.	Required

Context Output

Path	Type	Description
SentinelOne.Site.ID	String	The site ID.
SentinelOne.Site.Name	String	The site name.
SentinelOne.Site.State	String	The site state.
SentinelOne.Site.SKU	String	The SKU of product features active for this site.
SentinelOne.Site.SiteType	String	The site type.
SentinelOne.Site.Suite	String	The site suite.
SentinelOne.Site.TotalLicenses	String	The total licenses.
SentinelOne.Site.AccountID	String	The account ID.
SentinelOne.Site.Creator	String	Full name of the creating user.
SentinelOne.Site.CreatorID	String	ID of the creating user.
SentinelOne.Site.Description	String	Description of the site.
SentinelOne.Site.Expiration	String	Expiration date of the site.

sentinelone-fetch-threat-file

Fetch a file associated with the threat that matches the filter.

Base Command

sentinelone-fetch-threat-file

Input

Argument Name	Description	Required
threat_id	Please provide the Valid Threat ID. Example: 14629133470822878.	Required
password	File encryption password. (At least 10 characters, three out of this list “uppercase”, “lowercase”, “digits” and “symbols” are mandatory. Maximum length is 256 characters.).	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Downloadable	Boolean	Whether the file is downloadable.
SentinelOne.Threat.ZippedFile	String	Details of the zipped folder.

sentinelone-get-alerts

Get the list of alerts that matches the filter provided. Relevant for API version 2.1.

Base Command

sentinelone-get-alerts

Input

Argument Name	Description	Required
created_from	Greater than or equal to the time created. Example: “2018-02-27T04:49:26.257525Z”, “10 days”, “2 hours”,”5 months”.	Required
created_until	Less than or equal to the time created. Example: “2018-02-27T04:49:26.257525Z”, “10 days”, “2 hours”,”5 months”.	Optional
ruleName	Free-text filter by rule name. Example: “rule1”.	Optional
incidentStatus	Incident status. Example: “IN_PROGRESS”.	Optional
analystVerdict	Analyst verdict. Example: “TRUE_POSITIVE”.	Optional
alert_ids	A comma-separated list of alert IDs.	Optional
limit	Limit number of returned items (1-1000). Default is 1000.	Optional
site_ids	A comma-separated list of site IDs to filter by. Example: “225494730938493804,225494730938493915”.	Optional
cursor	Cursor position returned by the last request. Should be used for iterating over more than 1000 items. Example: “YWdlbnRfaWQ6NTgwMjkzODE=”.	Optional

Context Output

Path	Type	Description
SentinelOne.Alert.EventType	String	Event type.
SentinelOne.Alert.RuleName	String	The rule name.
SentinelOne.Alert.SrcProcUser	String	Source process user.
SentinelOne.Alert.SrcProcName	String	Source process name.
SentinelOne.Alert.SrcProcPath	String	Source process file path.
SentinelOne.Alert.SrcProcCommandline	String	The command line
SentinelOne.Alert.SrcProcSHA1	String	Source process SHA1 file hash.
SentinelOne.Alert.SrcProcStartTime	String	PID start time.
SentinelOne.Alert.SrcProcStorylineId	String	Source process story line ID.
SentinelOne.Alert.SrcParentProcName	String	Source parent process name.
SentinelOne.Alert.SrcParentProcPath	String	Source parent process file path.
SentinelOne.Alert.SrcParentProcCommandline	String	Source parent process command line.
SentinelOne.Alert.SrcParentProcStartTime	String	PID start time.
SentinelOne.Alert.SrcParentProcUser	String	Source parent process user.
SentinelOne.Alert.SrcParentProcSHA1	String	Source parent process SHA1 file hash.
SentinelOne.Alert.SrcProcSignerIdentity	String	Source process file signer identity.
SentinelOne.Alert.SrcParentProcSignerIdentity	String	Source parent process file signer identity.
SentinelOne.Alert.AlertCreatedAt	String	The the alert was created.
SentinelOne.Alert.AlertId	String	Alert ID.
SentinelOne.Alert.AnalystVerdict	String	Analyst verdict.
SentinelOne.Alert.IncidentStatus	String	Incident status
SentinelOne.Alert.EndpointName	String	Endpoint name
SentinelOne.Alert.AgentId	String	Agent ID.
SentinelOne.Alert.AgentUUID	String	Agent UUID.
SentinelOne.Alert.dvEventId	String	Deep Visibility event ID.
SentinelOne.Alert.AgentOS	String	Agent operating system.
SentinelOne.Alert.AgentVersion	String	Agent version.
SentinelOne.Alert.SiteId	String	Site ID.
SentinelOne.Alert.RuleId	String	Rule ID.

sentinelone-get-installed-applications

Get the installed applications for a specific agent.

Base Command

sentinelone-get-installed-applications

Input

Argument Name	Description	Required
agent_ids	A comma-separated list of agent IDs. Example: 14629133470822878,14627455454652878.	Required

Context Output

Path	Type	Description
SentinelOne.Application.Name	String	The application name.
SentinelOne.Application.Publisher	String	The publisher.
SentinelOne.Application.Size	String	The size of the application in bytes.
SentinelOne.Application.Version	String	The version of the application.
SentinelOne.Application.InstalledOn	String	The date the application was installed.

sentinelone-initiate-endpoint-scan

Initiate the endpoint virus scan on provided agent IDs.

Base Command

sentinelone-initiate-endpoint-scan

Input

Argument Name	Description	Required
agent_ids	A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878.	Required

Context Output

Path	Type	Description
SentinelOne.Agent.AgentID	String	The Agent ID.
SentinelOne.Agent.Initiated	Boolean	Whether the scan was initiated.

sentinelone-remove-item-from-whitelist

Remove an item from the SentinelOne exclusion list

Base Command

sentinelone-remove-item-from-whitelist

Input

Argument Name	Description	Required
item	Value of the item to be removed from the exclusion list.	Required
os_type	OS type. Can be “windows”, “windows_legacy”, “macos”, or “linux”. Possible values are: windows, windows_legacy, macos, linux.	Optional
exclusion_type	Exclusion item type. The options are: file_type, path, white_hash, certificate, or browser.	Optional

Context Output

Path	Type	Description
SentinelOne.RemoveItemFromWhitelist.status	String	Status on if items were removed from whitelist or not found on whitelist.
SentinelOne.RemoveItemFromWhitelist.item	String	Item removed fom whitelist.

sentinelone-run-remote-script

Run a remote script that was uploaded to the SentinelOne Script Library.

Base Command

sentinelone-run-remote-script

Input

Argument Name	Description	Required
account_ids	A comma-separated list of account IDs.	Required
output_destination	Output destination. Possible values: DataSetCloud/Local/None/SentinelCloud. Possible values are: DataSetCloud, Local, None, SentinelCloud.	Required
task_description	Task description.	Required
script_id	Script ID.	Required
output_directory	Output directory.	Optional
agent_ids	A comma-separated list of agent IDs on which the script should run.	Required
singularity_xdr_Keyword	Singularityxdr keyword.	Optional
singularity_xdr_Url	Singularityxdr keyword.	Optional
api_key	Api key.	Optional
input_params	Input params.	Optional
password	Password.	Optional
script_runtime_timeout_seconds	Script runtime timout in seconds for current execution.	Optional
requires_approval	If set to true, execution will require approval.	Optional

Context Output

Path	Type	Description
SentinelOne.RunRemoteScript.pendingExecutionId	string	ID of the created pending execution. Present only if pending flag is true.
SentinelOne.RunRemoteScript.pending	boolean	Flag indicating if the requested script execution requires approval and is created as a pending execution.
SentinelOne.RunRemoteScript.affected	number	Number of entities affected by the requested operation.
SentinelOne.RunRemoteScript.parentTaskId	string	The parent task ID of the script execution task. Null in case of pending execution.

sentinelone-get-remote-script-task-status

Get remote script tasks using a variety of filters.

Base Command

sentinelone-get-remote-script-task-status

Input

Argument Name	Description	Required
account_ids	A comma-separated list of account IDs. Example: ‘225494730938493804,225494730938493915’.	Optional
computer_name_contains	Free-text filter by agent computer name (supports multiple values).	Optional
count_only	If true, only total number of items will be returned, without any of the actual objects.	Optional
created_at_gt	Created at greater than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
created_at_gte	Created at greater or equal than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
created_at_lt	Created at lesser than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
created_at_lte	Created at lesser or equal than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
cursor	Cursor position returned by the last request. Use to iterate over more than 1000 items. Example: ‘YWdlbnRfaWQ6NTgwMjkzODE=’.	Optional
description_contains	Only include tasks with specific description.	Optional
detailed_status_contains	Only include tasks with specific detailed status.	Optional
group_ids	Comma-separated list of Group IDs to filter by. Example: ‘225494730938493804,225494730938493915’.	Optional
ids	Comma-separated list of IDs to filter by. Example: ‘225494730938493804,225494730938493915’.	Optional
initiated_by_contains	Only include tasks from specific initiating user.	Optional
limit	Limit number of returned items (1-1000). Example: ‘10’.	Optional
parent_task_id	Parent task ID to fetch the status by. Example: ‘225494730938493804’.	Required
parent_task_id_in	Comma-separated list of IDs to filter by.	Optional
query	A free-text search term that will match applicable attributes (sub-string match).	Optional
site_ids	Comma-separated list of Site IDs to filter by. Example: ‘225494730938493804,225494730938493915’.	Optional
status	Status of the script task. Example: ‘created’.	Optional
tenant	A tenant scope request.	Optional
updated_at_gt	Updated at greater than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
updated_at_gte	Updated at greater or equal than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
updated_at_lt	Updated at lesser than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
updated_at_lte	Updated at lesser or equal than datetime. Example: ‘2018-02-27T04:49:26.257525Z’.	Optional
uuid_contains	Free-text filter by agent UUID (supports multiple values).	Optional

Context Output

Path	Type	Description
SentinelOne.GetRemoteScript.id	string	ID of the task.
SentinelOne.GetRemoteScript.accountId	string	Account ID where this script is executed.
SentinelOne.GetRemoteScript.accountName	string	Account name where this script is executed.
SentinelOne.GetRemoteScript.agentId	string	Agent ID where this script is executed.
SentinelOne.GetRemoteScript.agentIsActive	boolean	The status of the agent.
SentinelOne.GetRemoteScript.agentMachineType	string	Agent machine type.
SentinelOne.GetRemoteScript.agentOsType	string	Agent operating system type.
SentinelOne.GetRemoteScript.agentUuid	string	Agent UUID.
SentinelOne.GetRemoteScript.createdAt	string	The script created at datetime.
SentinelOne.GetRemoteScript.description	string	The description of the remote script.
SentinelOne.GetRemoteScript.detailedStatus	string	The detailed status of the remote script.
SentinelOne.GetRemoteScript.groupId	string	Group ID where this script is executed.
SentinelOne.GetRemoteScript.groupName	string	Group name where this script is executed.
SentinelOne.GetRemoteScript.initiatedBy	string	Remote script initiate by.
SentinelOne.GetRemoteScript.initiatedById	string	ID of the remote script initiator.
SentinelOne.GetRemoteScript.parentTaskId	string	Parent task ID of the remote script.
SentinelOne.GetRemoteScript.siteId	string	Site ID where this script is executed.
SentinelOne.GetRemoteScript.siteName	string	Site name where this script is executed.
SentinelOne.GetRemoteScript.status	string	Status of the remote script.
SentinelOne.GetRemoteScript.statusCode	string	Status code of the remote script.
SentinelOne.GetRemoteScript.statusDescription	string	Status description of the remote script.
SentinelOne.GetRemoteScript.type	string	Type of remote script.
SentinelOne.GetRemoteScript.updateAt	string	Remote script upated at.

sentinelone-get-remote-script-task-results

Get a script’s result download URL.

Base Command

sentinelone-get-remote-script-task-results

Input

Argument Name	Description	Required
computer_names	A comma-separated list of partial or whole computer names, which ran scripts.	Optional
task_ids	A comma-separated list of task IDs to get a download link for.	Required

Context Output

Path	Type	Description
SentinelOne.RemoteScriptResults.taskId	string	ID of the task.
SentinelOne.RemoteScriptResults.fileName	string	File name.
SentinelOne.RemoteScriptResults.downloadUrl	string	Download URL.

sentinelone-remote-script-automate-results

Automate a remote script’s execution cycle and return the script’s results.

Base Command

sentinelone-remote-script-automate-results

Input

Argument Name	Description	Required
account_ids	A comma-separated list of account IDs.	Required
output_destination	Output destination. Possible values are: DataSetCloud, Local, None, SentinelCloud.	Required
task_description	Task description.	Required
script_id	Script ID.	Required
output_directory	Output directory.	Optional
agent_ids	A comma-separated list of agent IDs on which the script should run.	Required
singularity_xdr_Keyword	Singularity XDR keyword.	Optional
singularity_xdr_Url	Singularity XDR URL.	Optional
api_key	API key.	Optional
input_params	Input parameters.	Optional
password	Password.	Optional
script_runtime_timeout_seconds	Script runtime timeout in seconds for current execution.	Optional
requires_approval	If set to true, execution will require approval.	Optional
interval	Indicates how long to wait between command execution (in seconds) when ‘polling’ argument is true. Minimum value is 10 seconds. Default is 60.	Optional
timeout	Indicates the time in seconds until the polling sequence timeouts. Default is 600.	Optional
parent_task_id	Parent task ID to fetch the status by. Example: ‘225494730938493804’.	Optional

Context Output

Path	Type	Description
SentinelOne.RemoteScriptResults.taskId	string	ID of the task.
SentinelOne.RemoteScriptResults.fileName	string	File name.
SentinelOne.RemoteScriptResults.downloadUrl	string	Download URL.

sentinelone-get-power-query-results

Automate a power query and return the query results. (The maximum timeout of 300 seconds is allowed.)

Base Command

sentinelone-get-power-query-results

Input

Argument Name	Description	Required
account_ids	A comma-separated list of account IDs.	Optional
site_ids	A comma-separated list of site IDs on which the query should run.	Optional
query	Events matching the query search term will be returned.	Required
from_date	Events created after this date. Example: ‘2018-02-27T04:49:26.257525Z’.	Required
to_date	Events created before or at this date. Example: ‘2018-02-27T04:49:26.257525Z’.	Required
limit	Limit number of returned items (1-100000).	Optional
interval	Indicates how long to wait between command execution (in seconds) when ‘polling’ argument is true. Minimum value is 10 seconds.	Optional
timeout	Indicates the time in seconds until the polling sequence timeouts.	Optional
query_id	QueryId. Example: pq3be5e2747f716cxxxxxxxxxxxxx20a0.	Optional

Context Output

Path	Type	Description
SentinelOne.PowerQuery.ResultIndex	List	Result from the power query in list of objects format

get-mapping-fields

Returns the list of fields for an incident type.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

update-remote-system

Pushes local changes to the remote system.

Base Command

update-remote-system

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

get-remote-data

Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Argument Name	Description	Required
id	The ticket ID.	Required
lastUpdate	Retrieve entries that were created after lastUpdate.	Required

Context Output

There is no context output for this command.

get-modified-remote-data

Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

Base Command

get-modified-remote-data

Input

Argument Name	Description	Required
last_update	Retrieve entries that were created after lastUpdate.	Optional

Context Output

There is no context output for this command.

sentinelone-get-dv-query-status

Returns status of a Deep Visibility Query

Base Command

sentinelone-get-dv-query-status

Input

Argument Name	Description	Required
query_id	The queryId that is returned when creating a query under Create Query. Example: “q1xx2xx3”. Get the query_id from the “get-query-id” command.	Required

Context Output

Path	Type	Description
SentinelOne.Query.Status.progressStatus	string	Progress Query Status
SentinelOne.Query.Status.queryModeInfo.lastActivatedAt	string	Last Activated At
SentinelOne.Query.Status.queryModeInfo.mode	string	Query Mode
SentinelOne.Query.Status.responseState	string	State of the Query
SentinelOne.Query.Status.warnings	string	Warnings during Query
SentinelOne.Query.Status.QueryId	string	QueryID From Request

sentinelone-get-agent-mac

Returns network interface details for a given Agent ID. This includes MAC address details and interface description.

Base Command

sentinelone-get-agent-mac

Input

Argument Name	Description	Required
agent_id	AgentId of the System.	Required

Context Output

Path	Type	Description
SentinelOne.MAC	string	Agent network interface details.
SentinelOne.MAC.agent_id	string	AgentID
SentinelOne.MAC.hostname	string	Hostname
SentinelOne.MAC.int_name	string	Interface Name
SentinelOne.MAC.ip	string	IP Address
SentinelOne.MAC.mac	string	MAC Address

sentinelone-get-accounts

Returns details of accounts.

Base Command

sentinelone-get-accounts

Input

Argument Name	Description	Required
account_id	Can filter on one account ID. Otherwise, it returns information from all accounts.	Optional

Context Output

Path	Type	Description
SentinelOne.Accounts.AccountType	string	The account type.
SentinelOne.Accounts.ActiveAgents	number	The account number of active agents.
SentinelOne.Accounts.NumberOfSites	number	The account number of sites.
SentinelOne.Accounts.State	string	The account state.
SentinelOne.Accounts.CreatedAt	string	The account creation date.
SentinelOne.Accounts.Expiration	string	The account expiration date.
SentinelOne.Accounts.ID	string	The account ID.
SentinelOne.Accounts.Name	string	The account name.

sentinelone-get-threat-notes

Returns threat notes.

Base Command

sentinelone-get-threat-notes

Input

Argument Name	Description	Required
threat_id	The ID of the threat.	Required

Context Output

Path	Type	Description
SentinelOne.Notes.CreatedAt	string	The note creation date.
SentinelOne.Notes.Creator	string	The note creator.
SentinelOne.Notes.CreatorID	string	The note creator ID.
SentinelOne.Notes.Edited	boolean	Whether the note was edited or not..
SentinelOne.Notes.ID	string	The note ID.
SentinelOne.Notes.Text	string	The note text.
SentinelOne.Notes.UpdatedAt	string	The note updated time.

sentinelone-list-installed-singularity-marketplace-applications

Returns all installed singularity marketplace applications that match the specified filter values.

Base Command

sentinelone-list-installed-singularity-marketplace-applications

Input

Argument Name	Description	Required
account_ids	A comma-separated list of account IDs.	Optional
application_catalog_id	Filter results by application catalog id.	Optional
creator_contains	Free-text filter by application creator.	Optional
ids	A comma-separated list of applications IDs.	Optional
name_contains	Free-text filter by application name	Optional
site_ids	A comma-separated list of site IDs.	Optional

Context Output

Path	Type	Description
SentinelOne.InstalledApps.ID	string	The application ID.
SentinelOne.InstalledApps.Account	string	The account name.
SentinelOne.InstalledApps.AccountId	string	The account ID.
SentinelOne.InstalledApps.ApplicationCatalogId	string	The application Catalog ID.
SentinelOne.InstalledApps.ApplicationCatalogName	string	The application Catalog name.
SentinelOne.InstalledApps.AlertMessage	string	The alert message.
SentinelOne.InstalledApps.CreatedAt	date	Application created at.
SentinelOne.InstalledApps.Creator	string	Application creator.
SentinelOne.InstalledApps.CreatorId	string	Application creator ID.
SentinelOne.InstalledApps.DesiredStatus	string	Application desired status.
SentinelOne.InstalledApps.HasAlert	boolean	Application has alert.
SentinelOne.InstalledApps.LastEntityCreatedAt	date	Application last entity created at.
SentinelOne.InstalledApps.Modifier	string	Modifier.
SentinelOne.InstalledApps.ModifierId	string	Modifier ID.
SentinelOne.InstalledApps.ScopeId	string	The scope ID.
SentinelOne.InstalledApps.ScopeLevel	string	The scope level.
SentinelOne.InstalledApps.Status	string	Status of application.
SentinelOne.InstalledApps.UpdatedAt	string	Application updated at.
SentinelOne.InstalledApps.ApplicationInstanceName	string	Application instance name.

sentinelone-get-service-users

Returns all service users that match the specified filter values.

Base Command

sentinelone-get-service-users

Input

Argument Name	Description	Required
account_ids	A comma-separated list of account IDs.	Optional
role_ids	A comma-separated list of rbac roles to filter by.	Optional
ids	A comma-separated list of service user IDs to filter by.	Optional
site_ids	A comma-separated list of site IDs.	Optional

Context Output

Path	Type	Description
SentinelOne.ServiceUsers.ID	string	The service user ID.
SentinelOne.ServiceUsers.ApiTokenCreatedAt	date	Api token created at.
SentinelOne.ServiceUsers.ApiTokenExpiresAt	date	Api token expires at.
SentinelOne.ServiceUsers.CreatedAt	date	Service user created at.
SentinelOne.ServiceUsers.CreatedById	string	The service user created by Id.
SentinelOne.ServiceUsers.CreatedByName	string	The service user created by name.
SentinelOne.ServiceUsers.Description	string	Service user description.
SentinelOne.ServiceUsers.LastActivation	date	Last activation date.
SentinelOne.ServiceUsers.Name	string	Service user name.
SentinelOne.ServiceUsers.Scope	string	Service user scope.
SentinelOne.ServiceUsers.UpdatedAt	date	Service user updated at.
SentinelOne.ServiceUsers.UpdatedById	string	Service user updated by Id.
SentinelOne.ServiceUsers.UpdatedByName	string	Service user updated by name.
SentinelOne.ServiceUsers.ScopeRolesRoleId	string	Scope roles role Id.
SentinelOne.ServiceUsers.ScopeRolesRoleName	string	Scope roles role name.
SentinelOne.ServiceUsers.ScopeRolesAccountName	string	Scope roles account name.
SentinelOne.ServiceUsers.ScopeRolesId	string	Scope roles Id.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and SentinelOne v2 corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

Option	Description
None	Turns off incident mirroring.
Incoming	Any changes in SentinelOne v2 events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
Outgoing	Any changes in Cortex XSOAR incidents will be reflected in SentinelOne v2 events (outgoing mirrored fields).
Incoming And Outgoing	Changes in Cortex XSOAR incidents and SentinelOne v2 events will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and SentinelOne v2.

sentinelone-threat-download-from-cloud

Download a file associated with the threat from the Cloud (BinaryVault).

Base Command

sentinelone-threat-download-from-cloud

Input

Argument Name	Description	Required
threat_id	Please provide the Valid Threat ID. Example: 14629133470822878.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.ID	String	The threat ID.
SentinelOne.Threat.Downloadable	Boolean	Whether the file is downloadable.
SentinelOne.Threat.ZippedFile	String	Details of the zipped folder.

sentinelone-create-bulk-ioc

Adds a bulk list of IoCs to the Threat Intelligence database. To use this command, the user must upload a JSON file containing a list of IoC objects(each object represents a single IoC to be created) with the required attributes specified in the sentinelone-create-ioc command. Relevant for API version 2.1.

Base Command

sentinelone-create-bulk-ioc

Input

Argument Name	Description	Required
entry_id	Entry ID of uploaded IOCs JSON file.	Required
account_ids	List of account IDs to filter by.	Required

Context Output

Path	Type	Description
SentinelOne.IOC.UUID	String	The IOC UUID.
SentinelOne.IOC.Name	String	Threat Intelligence indicator name.
SentinelOne.IOC.Source	String	The source of the identified Threat Intelligence indicator.
SentinelOne.IOC.Type	String	The type of the Threat Intelligence indicator.
SentinelOne.IOC.BatchId	String	The IOC batch ID.
SentinelOne.IOC.Creator	String	The IOC creator.
SentinelOne.IOC.Scope	String	The IOC scope.
SentinelOne.IOC.ScopeId	String	The IOC scope ID.
SentinelOne.IOC.ValidUntil	String	Expiration date for the Threat Intelligence indicator.
SentinelOne.IOC.Description	String	Description of the Threat Intelligence indicator.
SentinelOne.IOC.ExternalId	String	The unique identifier of the indicator as provided by the Threat Intelligence source.

sentinelone-run-powerquery

Run a PowerQuery, where you can pipe one or many search expressions into a set of commands to transform, manipulate, group, and summarize your data.

Base Command

sentinelone-run-powerquery

Input

Argument Name	Description	Required
singularity_xdr_url	Singularity Data Lake XDR URL.	Required
singularity_xdr_api_key	A Log Read Access API key.	Required
query	The query, in PowerQuery syntax.	Required
start_time	Start time for your query.	Optional
end_time	End time for your query.	Optional
priority	Query execution priority (defaults to “low”). Default is low.	Optional
recurring	Optional (defaults to false). When set to true, a materialized view of your query is created. Possible values are: true, false. Default is false.	Optional
team_emails	Comma-separated list of account emails to query, enabling Cross Team Search.	Optional

Context Output

Path	Type	Description
SentinelOne.PowerQuery.Results.status	String	The status of the PowerQuery execution.
SentinelOne.PowerQuery.Results.matchingEvents	Number	Number of events that match the query’s initial filter.
SentinelOne.PowerQuery.Results.omittedEvents	Number	Number of events omitted from the final result due to memory limits.
SentinelOne.PowerQuery.Results.results	List	A list of result rows returned by the PowerQuery, where each object represents one row (column:value pairs).

sentinelone-abort-endpoint-scan

Abort the endpoint virus scan on provided agent IDs.

Base Command

sentinelone-abort-endpoint-scan

Input

Argument Name	Description	Required
agent_ids	A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878.	Required

Context Output

Path	Type	Description
SentinelOne.Agent.AgentID	String	The Agent ID.
SentinelOne.Agent.Aborted	Boolean	Whether the scan was aborted.

sentinelone-threat-analysis

Returns threat analysis. Can only be used with API V2.1.

Base Command

sentinelone-threat-analysis

Input

Argument Name	Description	Required
threat_id	Threat ID to get the analysis, for example: “2341398296147451190”.	Required

Context Output

Path	Type	Description
SentinelOne.Threat.AgentDetectionInfo	18	Agent detection time information.
SentinelOne.Threat.AgentRealtimeInfo	18	Agent realtime information.
SentinelOne.Threat.ThreatInfo	18	Threat information.

sentinelone-endpoint-fetch-logs

Get the Agent and Endpoint logs from Agents for provided agent IDs

Base Command

sentinelone-endpoint-fetch-logs

Input

Argument Name	Description	Required
agent_ids	A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878.	Required
agents_logs	Fetch Agent logs. Possible values are: true, false. Default is true.	Required
customer_facing_logs	Fetch customer-facing logs. Possible values are: true, false. Default is false.	Required
platform_logs	Actively fetch logs from the relevant platform (Windows, macOS, or Linux). Possible values are: true, false. Default is false.	Required

Context Output

Path	Type	Description
SentinelOne.Agent.Affected	String	Number of affected endpoints.

sentinelone-update-uam-alert-verdict

Updates the analyst verdict for a group of UAM alerts. Relevant for API version 2.1.

Base Command

sentinelone-update-uam-alert-verdict

Input

Argument Name	Description	Required
analyst_verdict	UAM alert analyst verdict. Possible values are: False positive - Benign, False positive - Benign but suspicious, False positive - System error, False positive - Undefined, False positive - User error, True positive - Advanced persistent threat, True positive - Benign, True positive - Benign but suspicious, True positive - Data exfiltration, True positive - Denial of service, True positive - Exploitation tools, True positive - Insider threat, True positive - Malware, True positive - Phishing attack, True positive - Policy violation, True positive - PUA/Adware, True positive - Ransomware, True positive - Unauthorized access, True positive - Undefined, Undefined.	Required
alert_ids	A comma-separated list of UAM alert IDs.	Required

Context Output

Path	Type	Description
SentinelOne.UAMAlert.ID	String	The UAM alert ID.
SentinelOne.UAMAlert.Updated	Boolean	Whether the analyst verdict was successfully updated.
SentinelOne.UAMAlert.AnalystVerdict	String	Name of the analyst verdict performed on the alerts.

sentinelone-update-uam-alert-status

Updates the status for a group of UAM alerts. Relevant for API version 2.1.

Base Command

sentinelone-update-uam-alert-status

Input

Argument Name	Description	Required
status	UAM alert status. Possible values are: New, In progress, Resolved.	Required
alert_ids	A comma-separated list of UAM alert IDs.	Required

Context Output

Path	Type	Description
SentinelOne.UAMAlert.ID	String	The UAM alert ID.
SentinelOne.UAMAlert.Updated	Boolean	Whether the status was successfully updated.
SentinelOne.UAMAlert.Status	String	Name of the status performed on the alerts.

sentinelone-export-threat-events

Exports the threat’s events as a JSON File. Relevant for API version 2.1.

Base Command

sentinelone-export-threat-events

Input

Argument Name	Description	Required
threat_id	Please provide the Valid Threat ID. Example: 14629133470822878.	Required

Context Output

Path	Type	Description
SentinelOne.Export.Events.ThreatId	String	The threat ID.
SentinelOne.Export.Events.Filename	String	The name of the file containing the Events.

sentinelone-export-full-threat-timeline

Exports the threat’s full timeline as a JSON File. Relevant for API version 2.1.

Base Command

sentinelone-export-full-threat-timeline

Input

Argument Name	Description	Required
threat_id	Please provide the Valid Threat ID. Example: 14629133470822878.	Required
limit	The max number of timeline entries to return, default is 5000.	Optional

Context Output

Path	Type	Description
SentinelOne.Export.Timeline.ThreatId	String	The threat ID.
SentinelOne.Export.Timeline.Filename	String	The name of the file containing the Timeline.

Configuration parameters

url — Server URL (e.g., https://usea1.sentinelone.net) (required)
credentials —
api_version — API Version (required)
isFetch — Fetch incidents
incidentType — Incident type
fetch_type — Fetch incidents from type
fetch_uam_alert_type — Fetch incidents from UAM Alert type
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
fetch_threat_rank — Minimum risk score for importing incidents (0-10), where 0 is low risk and 10 is high risk. Relevant for API version 2.0.
fetch_severity — Defines Alert severity to fetch.
fetch_incidentStatus — Define which Alerts should be fetched.
fetch_threat_incident_statuses — Define which Threats should be fetched.
fetch_limit — Fetch limit: The maximum number of threats or alerts to fetch
fetch_site_ids — Site IDs
block_site_ids — Block Site IDs
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
token — API Token (Deprecated)
incidentFetchInterval — Incidents Fetch Interval
mirror_direction — Incident Mirroring Direction
close_xsoar_incident — Close Mirrored XSOAR Incident

Commands (78)

get-mapping-fields
Returns the list of fields for an incident type.
get-modified-remote-data
Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
get-remote-data
Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
sentinelone-abort-endpoint-scan
Abort the endpoint virus scan on provided agent IDs.
sentinelone-add-hash-to-blocklist
Add a hash to the blocklist in SentinelOne. Supports scoping by site, group, or account. If Scope not provided, the block will be global.
sentinelone-agent-processes Deprecated
Deprecated. Retrieves running processes for a specific agent.
sentinelone-broadcast-message
Broadcasts a message to all agents that match the input filters.
sentinelone-connect-agent
Connects agents to the network.
sentinelone-create-bulk-ioc
Add bulk list of IoCs to the Threat Intelligence database. Relevant for API version 2.1.
sentinelone-create-ioc
Add an IoC to the Threat Intelligence database. Relevant for API version 2.1.
sentinelone-create-power-query Deprecated
Deprecated. Use ***sentinelone-get-power-query-results*** instead. Start a Deep Visibility Power query to get back status and potential results (ping afterwards using the queryId if query has not finished). Relevant for API version 2.1.
sentinelone-create-query
Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.
sentinelone-create-star-rule
Creates a custom STAR rule. Relevant for API version 2.1.
sentinelone-create-white-list-item
Creates an exclusion item that matches the specified input filter.
sentinelone-delete-group
Deletes a group, by the group ID.
sentinelone-delete-ioc
Delete an IOC from the Threat Intelligence database that matches a filter. Relevant for API version 2.1.
sentinelone-delete-star-rule
Deletes Custom Detection Rules that match the specified input filter. Relevant for API version 2.1.
sentinelone-disable-star-rules
Disable Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
sentinelone-disconnect-agent
Disconnects agents from the network.
sentinelone-download-fetched-file
Download a file fetched using th sentinelone-fetch-file command to submit the request and the sentinelone-get-activities command to get the download path.
sentinelone-enable-star-rules
Activate Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
sentinelone-endpoint-fetch-logs
Get the Agent and Endpoint logs from Agents for provided agent IDs.
sentinelone-expire-site
Expire the site of the given ID.
sentinelone-export-full-threat-timeline
Exports the threat's full timeline as a JSON File. Relevant for API version 2.1.
sentinelone-export-threat-events
Exports the threat's events as a JSON File. Relevant for API version 2.1.
sentinelone-fetch-file
Invokes a fetch files command against an agent endpoint.
sentinelone-fetch-threat-file
Fetch a file associated with the threat that matches the filter.
sentinelone-get-accounts
Returns details of accounts.
sentinelone-get-activities
Returns a list of activities.
sentinelone-get-agent
Returns the details of an agent according to the agent ID.
sentinelone-get-agent-mac
Returns network interface details for a given Agent ID. This includes MAC address details and interface description.
sentinelone-get-alerts
Get the list of alerts that matches the filter provided. Relevant for API version 2.1.
sentinelone-get-blocklist
Retrieve the blocklist ("blacklist" in SentinelOne). You can filter by SHA1 or SHA256 hash. If the `global` flag is `true`, then group_ids, site_ids, and account_ids are ignored.
sentinelone-get-dv-query-status
Returns status of a Deep Visibility Query.
sentinelone-get-events
Returns all Deep Visibility events that match the query.
sentinelone-get-groups
Returns data for the specified group.
sentinelone-get-hash
Gets the file reputation by a SHA1 hash.
sentinelone-get-installed-applications
Get the installed applications for a specific agent.
sentinelone-get-iocs
Get the IOCs of a specified account that match the filter. Relevant for API version 2.1.
sentinelone-get-power-query-results
Automate a power query and return the query results. (The maximum timeout of 300 seconds is allowed.)
sentinelone-get-processes
Returns a list of Deep Visibility events from query by event type - process.
sentinelone-get-remote-script-task-results
Get a script's result download URL.
sentinelone-get-remote-script-task-status
Get remote scripts tasks using a variety of filters.
sentinelone-get-service-users
Returns all service users that match the specified filter values.
sentinelone-get-site
Returns information about the site, according to the site ID.
sentinelone-get-sites
Returns all sites that match the specified criteria.
sentinelone-get-star-rules
Get a list of custom detection rules for a given scope. Relevant for API version 2.1.
sentinelone-get-threat-notes
Returns threat notes.
sentinelone-get-threats
Returns threats according to the specified filters.
sentinelone-get-white-list
Lists all exclusion items that match the specified input filter.
sentinelone-initiate-endpoint-scan
Initiate the endpoint virus scan on provided agent IDs.
sentinelone-list-agents
Returns all agents that match the specified criteria.
sentinelone-list-installed-singularity-marketplace-applications
Returns all installed singularity marketplace applications that match the specified filter values.
sentinelone-mark-as-threat
Marks suspicious threats as threats. Can only be used with API V2.0.
sentinelone-mitigate-threat
Applies a mitigation action to a group of threats that match the specified input filter.
sentinelone-move-agent
Moves agents to a new group.
sentinelone-ping-power-query Deprecated
Deprecated. Use ***sentinelone-get-power-query-results*** instead. Ping a Deep Visibility Power query using the queryId argument if results have not returned from an initial Power query or a previous ping. Relevant for API version 2.1.
sentinelone-reactivate-site
Reactivates an expired site.
sentinelone-remote-script-automate-results
Automate a remote script's execution cycle and return the script's results.
sentinelone-remove-hash-from-blocklist
Remove a hash from the global blocklist in SentinelOne.
sentinelone-remove-item-from-whitelist
Remove an item from the SentinelOne exclusion list.
sentinelone-resolve-threat
Resolves threats using the threat ID. Can only be used with API V2.0.
sentinelone-run-powerquery
Run a PowerQuery, where you can pipe one or many search expressions into a set of commands to transform, manipulate, group, and summarize your data.
sentinelone-run-remote-script
Run a remote script that was uploaded to the SentinelOne Script Library.
sentinelone-shutdown-agent
Sends a shutdown command to all agents that match the input filter.
sentinelone-threat-analysis
Returns threat analysis. Can only be used with API V2.1.
sentinelone-threat-download-from-cloud
Download a file associated with the threat from the Cloud (BinaryVault).
sentinelone-threat-summary
Returns a dashboard threat summary. Can only be used with API V2.1.
sentinelone-uninstall-agent
Sends an uninstall command to all agents that match the input filter.
sentinelone-update-alerts-status
Updates the incident status to a group of alerts that match the specified input filter. Relevant for API version 2.1.
sentinelone-update-alerts-verdict
Updates the analyst verdict to a group of alerts that match the specified input filter. Relevant for API version 2.1.
sentinelone-update-star-rule
Updates a custom STAR rule. Relevant for API version 2.1.
sentinelone-update-threats-status
Updates the incident status to a group of threats that match the specified input filter. Relevant for API version 2.1.
sentinelone-update-threats-verdict
Updates the analyst verdict to a group of threats that match the specified input filter. Relevant for API version 2.1.
sentinelone-update-uam-alert-status
Updates the status for a group of UAM alerts. Relevant for API version 2.1.
sentinelone-update-uam-alert-verdict
Updates the analyst verdict for a group of UAM alerts. Relevant for API version 2.1.
sentinelone-write-threat-note
Add a threat note to one or more threats. Relevant for API version 2.1.
update-remote-system
Pushes local changes to the remote system.

Source

SentinelOne-V2.py SentinelOne-V2_test.py SentinelOne-V2.yml SentinelOne-V2_description.md command_examples.txt

Download History Raw

category: Endpoint
provider: SentinelOne
sectionorder:
- Connect
- Collect
commonfields:
  id: SentinelOne V2
  version: -1
configuration:
- name: url
  display: Server URL (e.g., https://usea1.sentinelone.net)
  required: true
  type: 0
  section: Connect
- name: credentials
  display: ""
  type: 9
  section: Connect
  displaypassword: API Token
  hiddenusername: true
  required: false
- name: api_version
  display: API Version
  required: true
  defaultvalue: "2.1"
  type: 15
  section: Connect
  options:
  - "2.0"
  - "2.1"
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- name: fetch_type
  display: Fetch incidents from type
  defaultvalue: Threats
  type: 15
  section: Collect
  options:
  - Alerts
  - Threats
  - Both
  required: false
- name: fetch_uam_alert_type
  display: Fetch incidents from UAM Alert type
  type: 15
  section: Collect
  options:
  - ALL
  - CLOUD
  - CUSTOM_ALERTS
  - ENDPOINT
  - IDENTITY
  - STAR
  - THIRD_PARTY
  required: false
- name: fetch_time
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  defaultvalue: "3 days"
  type: 0
  section: Collect
  required: false
- name: fetch_threat_rank
  display: "Minimum risk score for importing incidents (0-10), where 0 is low risk and 10 is high risk. Relevant for API version 2.0."
  defaultvalue: '5'
  type: 0
  section: Collect
  required: false
- name: fetch_severity
  display: Defines Alert severity to fetch.
  type: 16
  section: Collect
  options:
  - High
  - Medium
  - Low
  - Critical
  required: false
- name: fetch_incidentStatus
  display: Define which Alerts should be fetched.
  type: 16
  section: Collect
  defaultvalue: UNRESOLVED
  options:
  - RESOLVED
  - UNRESOLVED
  - IN_PROGRESS
  required: false
- name: fetch_threat_incident_statuses
  display: 'Define which Threats should be fetched.'
  type: 16
  section: Collect
  defaultvalue: UNRESOLVED
  required: false
  options:
  - RESOLVED
  - UNRESOLVED
  - IN_PROGRESS
- name: fetch_limit
  display: 'Fetch limit: The maximum number of threats or alerts to fetch'
  type: 0
  section: Collect
  required: false
  defaultvalue: '10'
- name: fetch_site_ids
  display: Site IDs
  type: 0
  section: Collect
  additionalinfo: Comma-separated list of site IDs to fetch incidents for. Leave blank to fetch all sites.
  required: false
- name: block_site_ids
  display: Block Site IDs
  type: 0
  section: Collect
  required: false
  additionalinfo: Comma-separated list of site IDs for where hashes should be blocked. If left blank all hashes will be blocked globally. If filled out with site ids all hashes will be no longer be blocked globally, they will now be blocked in the scope of those sites.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: API Token (Deprecated)
  name: token
  type: 4
  hidden: true
  section: Connect
  required: false
  additionalinfo: Use the "API Token (Recommended)" parameter instead.
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
- additionalinfo: 'Choose the direction to mirror the incident: Incoming (from SentinelOne to Cortex XSOAR), Outgoing (from Cortex XSOAR to SentinelOne), or Incoming and Outgoing (from/to Cortex XSOAR and SentinelOne). Cortex XSOAR only parameter.'
  defaultvalue: None
  display: Incident Mirroring Direction
  name: mirror_direction
  type: 15
  section: Collect
  required: false
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  hidden:
  - marketplacev2
  - platform
- additionalinfo: When selected, closing the SentinelOne ticket is mirrored in Cortex XSOAR.
  defaultvalue: 'false'
  display: Close Mirrored XSOAR Incident
  name: close_xsoar_incident
  type: 8
  section: Collect
  required: false
description: Use the SentinelOne integration to send requests to your management server and get responses with data pulled from agents or from the management database.
display: SentinelOne v2
name: SentinelOne V2
script:
  commands:
  - arguments:
    - description: The computer name by which to filter the results. It can match a partial computer name value (substring).
      name: computer_name
    - auto: PREDEFINED
      description: 'A comma-separated list of scan statuses by which to filter the results, for example: "started,aborted".'
      name: scan_status
      predefined:
      - started
      - none
      - finished
      - aborted
    - auto: PREDEFINED
      description: 'Included operating system types, for example: "windows".'
      isArray: true
      name: os_type
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
    - description: 'Endpoint creation timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_at
    - description: Minimum number of threats per agent.
      name: min_active_threats
    - defaultValue: "10"
      description: The maximum number of agents to return.
      name: limit
    - description: Query params field=value pairs delimited by comma (e.g., activeThreats=3,gatewayIp=1.2.3.4). Query params are OR'd.
      name: params
    - description: A comma-separated list of additionals fields to display.
      name: columns
      isArray: true
    description: Returns all agents that match the specified criteria.
    name: sentinelone-list-agents
    outputs:
    - contextPath: SentinelOne.Agents.NetworkStatus
      description: The agent network status.
      type: string
    - contextPath: SentinelOne.Agents.ID
      description: The agent ID.
      type: string
    - contextPath: SentinelOne.Agents.AgentVersion
      description: The agent software version.
      type: string
    - contextPath: SentinelOne.Agents.IsDecommissioned
      description: Whether the agent is decommissioned.
      type: boolean
    - contextPath: SentinelOne.Agents.IsActive
      description: Whether the agent is active.
      type: boolean
    - contextPath: SentinelOne.Agents.LastActiveDate
      description: When was the agent last active.
      type: date
    - contextPath: SentinelOne.Agents.RegisteredAt
      description: The registration date of the agent.
      type: date
    - contextPath: SentinelOne.Agents.ExternalIP
      description: The agent IP address.
      type: string
    - contextPath: SentinelOne.Agents.ThreatCount
      description: Number of active threats.
      type: number
    - contextPath: SentinelOne.Agents.EncryptedApplications
      description: Whether disk encryption is enabled.
      type: boolean
    - contextPath: SentinelOne.Agents.OSName
      description: Name of operating system.
      type: string
    - contextPath: SentinelOne.Agents.ComputerName
      description: Name of agent computer.
      type: string
    - contextPath: SentinelOne.Agents.MachineType
      description: Machine type.
      type: string
    - contextPath: SentinelOne.Agents.Domain
      description: Domain name of the agent.
      type: string
    - contextPath: SentinelOne.Agents.CreatedAt
      description: Creation time of the agent.
      type: date
    - contextPath: SentinelOne.Agents.SiteName
      description: Site name associated with the agent.
      type: string
    - contextPath: SentinelOne.Agents.Tags
      description: Tags associated with the agent.
      type: unknown
  - arguments:
    - auto: PREDEFINED
      description: Exclusion item type.
      name: exclusion_type
      predefined:
      - file_type
      - path
      - white_hash
      - certificate
      - browser
      required: true
    - description: Value of the exclusion item for the exclusion list.
      name: exclusion_value
      required: true
    - auto: PREDEFINED
      description: Operating system type. Required for hash exclusions.
      name: os_type
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
      required: true
    - description: Description for adding the exclusion item.
      name: description
    - auto: PREDEFINED
      description: Exclusion mode (path exclusion only).
      name: exclusion_mode
      predefined:
      - suppress
      - disable_in_process_monitor_deep
      - disable_in_process_monitor
      - disable_all_monitors
      - disable_all_monitors_deep
    - description: Excluded path for a path exclusion list.
      name: path_exclusion_type
    - description: A comma-separated list of group IDs by which to filter.
      isArray: true
      name: group_ids
    - description: A comma-separated list of site IDs by which to filter.
      isArray: true
      name: site_ids
    description: Creates an exclusion item that matches the specified input filter.
    name: sentinelone-create-white-list-item
    outputs:
    - contextPath: SentinelOne.Exclusions.ID
      description: The entity ID on the allow list.
      type: string
    - contextPath: SentinelOne.Exclusions.Type
      description: The item type on the allow list.
      type: string
    - contextPath: SentinelOne.Exclusions.CreatedAt
      description: Time when the allow list item was created.
      type: date
  - arguments:
    - description: 'List of IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: item_ids
    - auto: PREDEFINED
      description: 'A comma-separated list of operating system types by which to filter, for example: "windows, linux".'
      isArray: true
      name: os_types
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
    - auto: PREDEFINED
      description: Exclusion type.
      name: exclusion_type
      predefined:
      - file_type
      - path
      - white_hash
      - certificate
      - browser
    - defaultValue: "10"
      description: The maximum number of items to return.
      name: limit
    - defaultValue: "false"
      description: Whether to include parent information of each item. Default value is false.
      name: include_parent
    - defaultValue: "false"
      description: Whether to include children information of each item. Default value is false.
      name: include_children
    description: Lists all exclusion items that match the specified input filter.
    name: sentinelone-get-white-list
    outputs:
    - contextPath: SentinelOne.Exclusions.ID
      description: The exclusion item ID.
      type: string
    - contextPath: SentinelOne.Exclusions.Type
      description: The exclusion item type.
      type: string
    - contextPath: SentinelOne.Exclusions.CreatedAt
      description: Timestamp when the exclusion item was added.
      type: date
    - contextPath: SentinelOne.Exclusions.Value
      description: Value of the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.Source
      description: Source of the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.UserID
      description: User ID of the user qho added the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.UpdatedAt
      description: Timestamp when the exclusion item was updated.
      type: date
    - contextPath: SentinelOne.Exclusions.OsType
      description: Operating system type of the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.UserName
      description: User name of the user who added the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.Mode
      description: 'A comma-separated list of modes by which to filter (path exclusions only), for example: "suppress".'
      type: string
  - arguments:
    - description: The content hash.
      name: hash
      required: true
    description: Gets the file reputation by a SHA1 hash.
    name: sentinelone-get-hash
    outputs:
    - contextPath: SentinelOne.Hash.Rank
      description: The hash reputation (1-10).
      type: Number
    - contextPath: SentinelOne.Hash.Verdict
      description: The verdict of a hash.
      type: String
    - contextPath: SentinelOne.Hash.Hash
      description: The content hash.
      type: String
  - arguments:
    - description: A comma-separated list of content hashes of the threat.
      isArray: true
      name: content_hash
    - auto: PREDEFINED
      description: A comma-separated list of mitigation statuses.
      isArray: true
      name: mitigation_status
      predefined:
      - mitigated
      - active
      - blocked
      - suspicious
      - pending
      - suspicious_resolved
    - description: 'Searches for threats created before this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_before
    - description: 'Searches for threats created after this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_after
    - description: 'Searches for threats created on or before this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_until
    - description: 'Search for threats created on or after this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_from
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to only return resolved threats.
      name: resolved
      predefined:
      - "false"
      - "true"
    - description: Threat display name. For API version 2.0 it can be a partial display name, doesn't have to be an exact match.
      name: display_name
    - defaultValue: "20"
      description: The maximum number of threats to return.
      name: limit
    - description: Full free-text search for fields. Can be "content_hash", "file_display_name", "file_path", "computer_name", or "uuid".
      name: query
    - description: 'A comma-separated list of threat IDs, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: threat_ids
    - auto: PREDEFINED
      description: 'A comma-separated list of threat classifications to search, for example: "Malware", "Network", "Benign".'
      name: classifications
      predefined:
      - Engine
      - Static
      - Cloud
      - Behavioral
    - description: Risk level threshold to retrieve (1-10). Relevant for API version 2.0 only.
      name: rank
    - description: 'A comma-separated list of site IDs to search for threats, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: site_ids
    - description: 'Incident status. Example: "IN_PROGRESS, UNRESOLVED".'
      name: incident_statuses
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to include the resolved parameter in the query.
      name: include_resolved_param
      predefined:
      - "false"
      - "true"
    description: Returns threats according to the specified filters.
    name: sentinelone-get-threats
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.AgentComputerName
      description: The agent computer name.
      type: String
    - contextPath: SentinelOne.Threat.CreatedDate
      description: The threat creation date.
      type: Date
    - contextPath: SentinelOne.Threat.SiteID
      description: The site ID.
      type: String
    - contextPath: SentinelOne.Threat.Classification
      description: The threat classification.
      type: string
    - contextPath: SentinelOne.Threat.ClassificationSource
      description: Source of the threat classification.
      type: string
    - contextPath: SentinelOne.Threat.ConfidenceLevel
      description: SentinelOne threat confidence level.
      type: string
    - contextPath: SentinelOne.Threat.FileSha256
      description: SHA256 hash of the file content.
      type: string
    - contextPath: SentinelOne.Threat.MitigationStatus
      description: The agent mitigation status.
      type: String
    - contextPath: SentinelOne.Threat.AgentID
      description: The threat agent ID.
      type: String
    - contextPath: SentinelOne.Threat.Rank
      description: The number representing the cloud reputation (1-10).
      type: Number
    - contextPath: SentinelOne.Threat.MarkedAsBenign
      description: Whether the threat is marked as benign. Relevant for version 2.0 only.
      type: Boolean
  - arguments:
    - description: 'A comma-separated list of group IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: group_ids
    description: Returns a dashboard threat summary. Can only be used with API V2.1.
    name: sentinelone-threat-summary
    outputs:
    - contextPath: SentinelOne.Threat.NotResolved
      description: Number of unresolved threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.SuspiciousNotMitigatedNotResolved
      description: Number of unmitigated suspicious threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.SuspiciousNotResolved
      description: Number of unresolved suspicious threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.Resolved
      description: Number of resolved threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.InProgress
      description: Number of active threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.Total
      description: Total number of threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.NotMitigated
      description: Number of unmitigated threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.MaliciousNotResolved
      description: Number of unresolved malicious threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.NotMitigatedNotResolved
      description: Number of unmitigated and unresolved threats in the system.
      type: Number
  - arguments:
    - description: 'Threat ID to get the analysis, for example: "2341398296147451190".'
      name: threat_id
      required: true
    description: Returns threat analysis. Can only be used with API V2.1.
    name: sentinelone-threat-analysis
    outputs:
    - contextPath: SentinelOne.Threat.AgentDetectionInfo
      description: Agent detection time information.
      type: 18
    - contextPath: SentinelOne.Threat.AgentRealtimeInfo
      description: Agent realtime information.
      type: 18
    - contextPath: SentinelOne.Threat.ThreatInfo
      description: Threat information.
      type: 18
  - arguments:
    - description: A comma-separated list of threat IDs.
      isArray: true
      name: threat_ids
    - auto: PREDEFINED
      description: Scope to use for exclusions.
      name: target_scope
      predefined:
      - site
      - tenant
      required: true
    description: Marks suspicious threats as threats. Can only be used with API V2.0.
    name: sentinelone-mark-as-threat
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.MarkedAsThreat
      description: Whether the suspicious threat was successfully marked as a threat.
      type: Boolean
  - arguments:
    - auto: PREDEFINED
      description: Mitigation action.
      name: action
      predefined:
      - kill
      - quarantine
      - un-quarantine
      - remediate
      - rollback-remediation
      required: true
    - description: A comma-separated list of threat IDs.
      isArray: true
      name: threat_ids
      required: true
    description: Applies a mitigation action to a group of threats that match the specified input filter.
    name: sentinelone-mitigate-threat
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Mitigated
      description: Whether the threat was successfully mitigated.
      type: Boolean
    - contextPath: SentinelOne.Threat.Mitigation.Action
      description: The mitigation action performed.
      type: String
  - arguments:
    - description: A comma-separated list of threat IDs.
      isArray: true
      name: threat_ids
      required: true
    description: Resolves threats using the threat ID. Can only be used with API V2.0.
    name: sentinelone-resolve-threat
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Resolved
      description: Whether the threat was successfully resolved.
      type: Boolean
  - arguments:
    - description: A comma-separated list of agent IDs.
      isArray: true
      name: agent_id
      required: true
    description: Returns the details of an agent according to the agent ID.
    name: sentinelone-get-agent
    outputs:
    - contextPath: SentinelOne.Agent.NetworkStatus
      description: The agent network status.
      type: string
    - contextPath: SentinelOne.Agent.ID
      description: The agent ID.
      type: string
    - contextPath: SentinelOne.Agent.AgentVersion
      description: The agent software version.
      type: string
    - contextPath: SentinelOne.Agent.IsDecommissioned
      description: Whether the agent is decommissioned.
      type: boolean
    - contextPath: SentinelOne.Agent.IsActive
      description: Whether the agent is active.
      type: boolean
    - contextPath: SentinelOne.Agent.LastActiveDate
      description: When was the agent last active.
      type: date
    - contextPath: SentinelOne.Agent.RegisteredAt
      description: The registration date of the agent.
      type: date
    - contextPath: SentinelOne.Agent.ExternalIP
      description: The agent IP address.
      type: string
    - contextPath: SentinelOne.Agent.ThreatCount
      description: Number of active threats.
      type: number
    - contextPath: SentinelOne.Agent.EncryptedApplications
      description: Whether disk encryption is enabled.
      type: boolean
    - contextPath: SentinelOne.Agent.OSName
      description: Name of the operating system.
      type: string
    - contextPath: SentinelOne.Agent.ComputerName
      description: Name of the agent computer.
      type: string
    - contextPath: SentinelOne.Agent.MachineType
      description: Machine type.
      type: string
    - contextPath: SentinelOne.Agent.Domain
      description: Domain name of the agent.
      type: string
    - contextPath: SentinelOne.Agent.CreatedAt
      description: Agent creation time.
      type: date
    - contextPath: SentinelOne.Agent.SiteName
      description: Site name associated with the agent.
      type: string
  - arguments:
    - description: 'Timestamp of the last update, for example: "2018-02-27T04:49:26.257525Z".'
      name: updated_at
    - description: "Full-text search for fields: name, account_name."
      name: query
    - auto: PREDEFINED
      description: Site type.
      name: site_type
      predefined:
      - Trial
      - Paid
      - POC
      - DEV
      - NFR
    - auto: PREDEFINED
      description: Returns sites that support the specified features.
      name: features
      predefined:
      - firewall-control
      - device-control
      - ioc
    - auto: PREDEFINED
      description: Site state.
      name: state
      predefined:
      - active
      - deleted
      - expired
    - auto: PREDEFINED
      description: The suite of product features active for this site.
      name: suite
      predefined:
      - Core
      - Complete
    - auto: PREDEFINED
      description: Sites for which the user has admin privileges.
      name: admin_only
      predefined:
      - "true"
      - "false"
    - description: 'Account ID, for example: "225494730938493804".'
      name: account_id
    - description: 'Site name, for example: "My Site".'
      name: site_name
    - description: 'Timestamp of the site creation, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_at
    - defaultValue: "50"
      description: Maximum number of results to return.
      name: limit
    description: Returns all sites that match the specified criteria.
    name: sentinelone-get-sites
    outputs:
    - contextPath: SentinelOne.Site.Creator
      description: The site creator name.
      type: string
    - contextPath: SentinelOne.Site.Name
      description: The site name.
      type: string
    - contextPath: SentinelOne.Site.Type
      description: The site type.
      type: string
    - contextPath: SentinelOne.Site.AccountName
      description: The site account name.
      type: string
    - contextPath: SentinelOne.Site.State
      description: The site state.
      type: string
    - contextPath: SentinelOne.Site.HealthStatus
      description: The health status of the site.
      type: boolean
    - contextPath: SentinelOne.Site.Suite
      description: The suite to which the site belongs.
      type: string
    - contextPath: SentinelOne.Site.ActiveLicenses
      description: Number of active licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.ID
      description: ID of the site.
      type: string
    - contextPath: SentinelOne.Site.TotalLicenses
      description: Number of total licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.CreatedAt
      description: Timestamp when the site was created.
      type: date
    - contextPath: SentinelOne.Site.Expiration
      description: Timestamp when the site will expire.
      type: string
    - contextPath: SentinelOne.Site.UnlimitedLicenses
      description: Whether the site has unlimited licenses.
      type: boolean
  - arguments:
    - description: ID of the site.
      name: site_id
      required: true
    description: Returns information about the site, according to the site ID.
    name: sentinelone-get-site
    outputs:
    - contextPath: SentinelOne.Site.Creator
      description: The site creator name.
      type: string
    - contextPath: SentinelOne.Site.Name
      description: The site name.
      type: string
    - contextPath: SentinelOne.Site.Type
      description: The site type.
      type: string
    - contextPath: SentinelOne.Site.AccountName
      description: The site account name.
      type: string
    - contextPath: SentinelOne.Site.State
      description: The site state.
      type: string
    - contextPath: SentinelOne.Site.HealthStatus
      description: The health status of the site.
      type: boolean
    - contextPath: SentinelOne.Site.Suite
      description: The suite to which the site belongs.
      type: string
    - contextPath: SentinelOne.Site.ActiveLicenses
      description: Number of active licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.ID
      description: ID of the site.
      type: string
    - contextPath: SentinelOne.Site.TotalLicenses
      description: Number of total licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.CreatedAt
      description: Timestamp when the site was created.
      type: date
    - contextPath: SentinelOne.Site.Expiration
      description: Timestamp when the site will expire.
      type: string
    - contextPath: SentinelOne.Site.UnlimitedLicenses
      description: Whether the site has unlimited licenses.
      type: boolean
    - contextPath: SentinelOne.Site.AccountID
      description: Site account ID.
      type: string
    - contextPath: SentinelOne.Site.IsDefault
      description: Whether the site is the default site.
      type: boolean
  - arguments:
    - description: 'Site ID. For example: "225494730938493804".'
      name: site_id
      required: true
    - description: If false, an expiration should be supplied.
      name: unlimited
    - description: Expiration date in case unlimited is false, for example, "2019-08-03T04:49:26.257525Z".
      name: expiration
    description: Reactivates an expired site.
    name: sentinelone-reactivate-site
    outputs:
    - contextPath: SentinelOne.Site.ID
      description: Site ID.
      type: string
    - contextPath: SentinelOne.Site.Reactivated
      description: Whether the site was reactivated.
      type: boolean
  - arguments:
    - description: 'Return activities created after this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_after
    - description: Email address of the user who invoked the activity (if applicable).
      name: user_emails
    - description: 'List of group IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: group_ids
    - description: 'Return activities created on or before this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_until
    - auto: PREDEFINED
      description: Include internal activities hidden from display.
      name: include_hidden
      predefined:
      - "true"
      - "false"
    - description: 'A comma-separated list of activity IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: activities_ids
    - description: 'Return activities created before this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_before
    - description: 'A comma-separated list of threat IDs for which to return activities, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: threats_ids
    - description: 'A comma-separated list of activity codes to return, for example: "52,53,71,72".'
      isArray: true
      name: activity_types
    - description: 'A comma-separated list of user IDs for users that invoked the activity (if applicable), for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: user_ids
    - description: 'Return activities created on or after this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_from
    - description: 'Return activities created within this range (inclusive), for example: "1514978764288-1514978999999".'
      name: created_between
    - description: 'Return activities related to specified agents. For example: "225494730938493804,225494730938493915".'
      isArray: true
      name: agent_ids
    - description: Maximum number of items to return (1-100).
      name: limit
    - name: sort_by
      auto: PREDEFINED
      predefined:
      - activityType
      - createdAt
      - id
      description: Field to sort results by.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Order to sort by.
    description: Returns a list of activities.
    name: sentinelone-get-activities
    outputs:
    - contextPath: SentinelOne.Activity.AgentID
      description: Related agent (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.AgentUpdatedVersion
      description: Agent's new version (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.SiteID
      description: Related site (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.UserID
      description: The user who invoked the activity (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.SecondaryDescription
      description: Secondary description.
      type: String
    - contextPath: SentinelOne.Activity.OsFamily
      description: Agent's operating system type (if applicable). Can be "linux", "macos", "windows", or "windows_legacy".
      type: String
    - contextPath: SentinelOne.Activity.ActivityType
      description: Activity type.
      type: Number
    - contextPath: SentinelOne.Activity.data.SiteID
      description: The site ID.
      type: String
    - contextPath: SentinelOne.Activity.data.SiteName
      description: The site name.
      type: String
    - contextPath: SentinelOne.Activity.data.username
      description: The name of the site creator.
      type: String
    - contextPath: SentinelOne.Activity.Hash
      description: Threat file hash (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.UpdatedAt
      description: Activity last updated time (UTC).
      type: Date
    - contextPath: SentinelOne.Activity.Comments
      description: Comments for the activity.
      type: String
    - contextPath: SentinelOne.Activity.ThreatID
      description: Related threat (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.PrimaryDescription
      description: Primary description for the activity.
      type: String
    - contextPath: SentinelOne.Activity.GroupID
      description: Related group (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.ID
      description: Activity ID.
      type: String
    - contextPath: SentinelOne.Activity.CreatedAt
      description: Activity creation time (UTC).
      type: Date
    - contextPath: SentinelOne.Activity.Description
      description: Extra activity information.
      type: String
  - arguments:
    - description: 'Group type, for example: "static".'
      name: group_type
    - description: 'A comma-separated list of group IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: group_ids
    - description: 'Group ID by which to filter, for example: "225494730938493804".'
      name: group_id
    - auto: PREDEFINED
      description: Whether this is the default group.
      name: is_default
      predefined:
      - "true"
      - "false"
    - description: The name of the group.
      name: name
    - description: Free-text search.
      name: query
    - description: The priority of a dynamic group over others, for example, "1", which is the highest priority.
      name: rank
    - description: Maximum number of items to return (1-200).
      name: limit
    description: Returns data for the specified group.
    name: sentinelone-get-groups
    outputs:
    - contextPath: SentinelOne.Group.siteId
      description: The ID of the site of which this group is a member.
      type: String
    - contextPath: SentinelOne.Group.filterName
      description: If the group is dynamic, the name of the filter which is used to associate agents.
      type: String
    - contextPath: SentinelOne.Group.creatorId
      description: The ID of the user who created the group.
      type: String
    - contextPath: SentinelOne.Group.name
      description: The name of the group.
      type: String
    - contextPath: SentinelOne.Group.creator
      description: The user who created the group.
      type: String
    - contextPath: SentinelOne.Group.rank
      description: The rank, which sets the priority of a dynamic group over others.
      type: Number
    - contextPath: SentinelOne.Group.updatedAt
      description: Timestamp of the last update.
      type: Date
    - contextPath: SentinelOne.Group.totalAgents
      description: Number of agents in the group.
      type: Number
    - contextPath: SentinelOne.Group.filterId
      description: If the group is dynamic, the group ID of the filter that is used to associate agents.
      type: String
    - contextPath: SentinelOne.Group.isDefault
      description: Whether the groups is the default group of the site.
      type: Boolean
    - contextPath: SentinelOne.Group.inherits
      description: Whether the policy is inherited from a site. "False" if the group has its own edited policy.
      type: Boolean
    - contextPath: SentinelOne.Group.type
      description: Group type. Can be static or dynamic.
      type: String
    - contextPath: SentinelOne.Group.id
      description: The ID of the group.
      type: String
    - contextPath: SentinelOne.Group.createdAt
      description: Timestamp of group creation.
      type: Date
  - arguments:
    - description: The ID of the group to move the agent to.
      name: group_id
      required: true
    - description: Agents IDs.
      isArray: true
      name: agents_ids
    description: Moves agents to a new group.
    name: sentinelone-move-agent
    outputs:
    - contextPath: SentinelOne.Agent.AgentsMoved
      description: The number of agents that were moved to another group.
      type: Number
  - arguments:
    - description: The ID of the group to delete.
      name: group_id
      required: true
    description: Deletes a group, by the group ID.
    name: sentinelone-delete-group
    outputs:
    - contextPath: SentinelOne.DeleteGroup.Success
      description: The status of the command.
      type: String
  - arguments:
    - description: The ID of the agent from which to retrieve the processes.
      name: agents_ids
      required: true
    deprecated: true
    description: Deprecated. Retrieves running processes for a specific agent.
    name: sentinelone-agent-processes
    outputs:
    - contextPath: SentinelOne.Agent.memoryUsage
      description: Memory usage (MB).
      type: Number
    - contextPath: SentinelOne.Agent.startTime
      description: The process start time.
      type: Date
    - contextPath: SentinelOne.Agent.pid
      description: The process ID.
      type: Number
    - contextPath: SentinelOne.Agent.processName
      description: The name of the process.
      type: String
    - contextPath: SentinelOne.Agent.cpuUsage
      description: CPU usage (%).
      type: Number
    - contextPath: SentinelOne.Agent.executablePath
      description: Executable path.
      type: String
  - arguments:
    - description: A comma-separated list of agent IDs to connect to the network. Run the list-agents command to get a list of agent IDs.
      isArray: true
      name: agent_id
      required: true
    description: Connects agents to the network.
    name: sentinelone-connect-agent
    outputs:
    - contextPath: SentinelOne.Agent.AgentsAffected
      description: The number of affected agents.
      type: Number
    - contextPath: SentinelOne.Agent.NetworkStatus
      description: Agent network status.
      type: String
    - contextPath: SentinelOne.Agent.ID
      description: Input agents' IDs.
      type: String
  - arguments:
    - description: A comma-separated list of agent IDs to disconnect from the network. Run the list-agents command to get a list of agent IDs.
      isArray: true
      name: agent_id
      required: true
    description: Disconnects agents from the network.
    name: sentinelone-disconnect-agent
    outputs:
    - contextPath: SentinelOne.Agent.NetworkStatus
      description: Agent network status.
      type: String
    - contextPath: SentinelOne.Agent.ID
      description: Input agents' IDs.
      type: String
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: The message to broadcast to agents.
      name: message
      required: true
    - auto: PREDEFINED
      description: Whether to only include active agents. Default is "false".
      name: active_agent
      predefined:
      - "true"
      - "false"
    - description: A comma-separated list of group IDs by which to filter the results.
      isArray: true
      name: group_id
    - description: A comma-separated list of agent IDs by which to filter the results.
      isArray: true
      name: agent_id
    - description: A comma-separated of included network domains.
      isArray: true
      name: domain
    description: Broadcasts a message to all agents that match the input filters.
    name: sentinelone-broadcast-message
    outputs:
    - contextPath: SentinelOne.BroadcastMessage.Affected
      description: Number of affected endpoints.
      type: String
  - arguments:
    - defaultValue: "50"
      description: Maximum number of items to return (1-100).
      name: limit
    - description: 'QueryId obtained when creating a query in the sentinelone-create-query command. Example: "q1xx2xx3".'
      name: query_id
      required: true
    - description: Cursor pointer to get next page of results from query.
      name: cursor
    - description: A comma-separated list of additionals fields to display.
      name: columns
      isArray: true
    description: Returns all Deep Visibility events that match the query.
    name: sentinelone-get-events
    outputs:
    - contextPath: SentinelOne.Event.ProcessUID
      description: Process unique identifier.
      type: String
    - contextPath: SentinelOne.Event.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: SentinelOne.Event.AgentOS
      description: Operating system type. Can be "windows", "linux", "macos", or "windows_legac".
      type: String
    - contextPath: SentinelOne.Event.ProcessID
      description: The process ID.
      type: Number
    - contextPath: SentinelOne.Event.User
      description: User assigned to the event.
      type: String
    - contextPath: SentinelOne.Event.Time
      description: Process start time.
      type: Date
    - contextPath: SentinelOne.Event.Endpoint
      description: The agent name.
      type: String
    - contextPath: SentinelOne.Event.SiteName
      description: Site name.
      type: String
    - contextPath: SentinelOne.Event.EventType
      description: Event type. Can be "events", "file", "ip", "url", "dns", "process", "registry", "scheduled_task", or "logins".
      type: String
    - contextPath: SentinelOne.Event.ProcessName
      description: The name of the process.
      type: String
    - contextPath: SentinelOne.Event.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: SentinelOne.Event.SourceIP
      description: The source ip.
      type: String
    - contextPath: SentinelOne.Event.SourcePort
      description: The source port.
      type: String
    - contextPath: SentinelOne.Event.DestinationIP
      description: The destination IP.
      type: String
    - contextPath: SentinelOne.Event.DestinationPort
      description: The destination port.
      type: String
    - contextPath: SentinelOne.Event.SourceProcessUser
      description: The source process user.
      type: String
    - contextPath: SentinelOne.Event.SourceProcessCommandLine
      description: The source process command line.
      type: String
    - contextPath: SentinelOne.Event.DNSRequest
      description: The DNS Request.
      type: String
    - contextPath: SentinelOne.Event.FileFullName
      description: The file full name.
      type: String
    - contextPath: SentinelOne.Event.EventTime
      description: The event time.
      type: String
    - contextPath: Event.ID
      description: Event process ID.
      type: String
    - contextPath: Event.Name
      description: Event name.
      type: String
    - contextPath: Event.Type
      description: Event type.
      type: String
    - contextPath: SentinelOne.Cursor.Event
      description: cursor to recieve next page.
      type: String
  - arguments:
    - description: The query string for which to return events.
      name: query
      required: true
    - description: Query start date, for example, "2019-08-03T04:49:26.257525Z". Limited to 93 days ago.
      name: from_date
      required: true
    - description: Query end date, for example, "2019-08-03T04:49:26.257525Z".
      name: to_date
      required: true
    description: Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.
    name: sentinelone-create-query
    outputs:
    - contextPath: SentinelOne.Query.FromDate
      description: Query start date.
      type: Date
    - contextPath: SentinelOne.Query.Query
      description: The search query string.
      type: String
    - contextPath: SentinelOne.Query.QueryID
      description: The query ID.
      type: String
    - contextPath: SentinelOne.Query.ToDate
      description: Query end date.
      type: Date
  - arguments:
    - description: 'The queryId that is returned when creating a query under Create Query. Example: "q1xx2xx3". Get the query_id from the "get-query-id" command.'
      name: query_id
      required: true
    - defaultValue: "50"
      description: Maximum number of items to return (1-100).
      name: limit
    description: Returns a list of Deep Visibility events from query by event type - process.
    name: sentinelone-get-processes
    outputs:
    - contextPath: SentinelOne.Event.ParentProcessID
      description: Parent process ID.
      type: Number
    - contextPath: SentinelOne.Event.ProcessUID
      description: The process unique identifier.
      type: String
    - contextPath: SentinelOne.Event.SHA1
      description: SHA1 hash of the process image.
      type: String
    - contextPath: SentinelOne.Event.SubsystemType
      description: Process sub-system.
      type: String
    - contextPath: SentinelOne.Event.ParentProcessStartTime
      description: The parent process start time.
      type: Date
    - contextPath: SentinelOne.Event.ProcessID
      description: The process ID.
      type: Number
    - contextPath: SentinelOne.Event.ParentProcessUID
      description: Parent process unique identifier.
      type: String
    - contextPath: SentinelOne.Event.User
      description: User assigned to the event.
      type: String
    - contextPath: SentinelOne.Event.Time
      description: Start time of the process.
      type: Date
    - contextPath: SentinelOne.Event.ParentProcessName
      description: Parent process name.
      type: String
    - contextPath: SentinelOne.Event.SiteName
      description: Site name.
      type: String
    - contextPath: SentinelOne.Event.EventType
      description: The event type.
      type: String
    - contextPath: SentinelOne.Event.Endpoint
      description: The agent name (endpoint).
      type: String
    - contextPath: SentinelOne.Event.IntegrityLevel
      description: Process integrity level.
      type: String
    - contextPath: SentinelOne.Event.CMD
      description: Process CMD.
      type: String
    - contextPath: SentinelOne.Event.ProcessName
      description: Process name.
      type: String
    - contextPath: SentinelOne.Event.ProcessDisplayName
      description: Process display name.
      type: String
  - arguments:
    - description: "A free-text search term that will match applicable attributes (sub-string match). Note: A device's physical addresses will only be matched if they start with the search term (not if they contain the search term)."
      name: query
    - description: A comma-separated list of agents IDs to shutdown.
      isArray: true
      name: agent_id
    - description: The ID of the network group.
      name: group_id
    description: Sends a shutdown command to all agents that match the input filter.
    name: sentinelone-shutdown-agent
    outputs:
    - contextPath: SentinelOne.Agent.ID
      description: The ID of the agent that was shutdown.
      type: String
  - arguments:
    - description: "A free-text search term that will match applicable attributes (sub-string match). Note: A device's physical addresses will only be matched if they start with the search term (not if they contain the search term)."
      name: query
    - description: A comma-separated list of agents IDs to shutdown.
      name: agent_id
    - description: The ID of the network group.
      name: group_id
    description: Sends an uninstall command to all agents that match the input filter.
    name: sentinelone-uninstall-agent
    outputs:
    - contextPath: SentinelOne.uninstall.Affected
      description: Number of affected agents.
      type: String
  - arguments:
    - name: verdict
      required: true
      auto: PREDEFINED
      predefined:
      - undefined
      - true_positive
      - false_positive
      - suspicious
      description: Analyst verdict action.
    - name: threat_ids
      required: true
      description: A comma-separated list of threat IDs.
      isArray: true
    description: Updates the analyst verdict to a group of threats that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-update-threats-verdict
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Updated
      description: Whether the threat was successfully updated in the analyst verdict.
      type: Boolean
    - contextPath: SentinelOne.Threat.Update.Action
      description: Name of the analyst verdict action performed on the threats.
      type: String
  - arguments:
    - name: verdict
      required: true
      auto: PREDEFINED
      predefined:
      - undefined
      - true_positive
      - false_positive
      - suspicious
      description: Analyst verdict action.
    - name: alert_ids
      required: true
      description: A comma-separated list of alert IDs.
      isArray: true
    description: Updates the analyst verdict to a group of alerts that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-update-alerts-verdict
    outputs:
    - contextPath: SentinelOne.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: SentinelOne.Alert.Updated
      description: Whether the alert was successfully updated in the analyst verdict.
      type: Boolean
    - contextPath: SentinelOne.Alert.Update.Action
      description: Name of the analyst verdict action performed on the alerts.
      type: String
  - arguments:
    - name: status
      required: true
      description: UAM alert status.
      auto: PREDEFINED
      predefined:
      - New
      - In progress
      - Resolved
    - name: alert_ids
      required: true
      description: A comma-separated list of UAM alert IDs.
      isArray: true
    description: Updates the status for a group of UAM alerts. Relevant for API version 2.1.
    name: sentinelone-update-uam-alert-status
    outputs:
    - contextPath: SentinelOne.UAMAlert.ID
      description: The UAM alert ID.
      type: String
    - contextPath: SentinelOne.UAMAlert.Updated
      description: Whether the status was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.UAMAlert.Status
      description: Name of the status performed on the alerts.
      type: String
  - arguments:
    - name: analyst_verdict
      description: 'UAM alert analyst verdict.'
      required: true
      auto: PREDEFINED
      predefined:
      - False positive - Benign
      - False positive - Benign but suspicious
      - False positive - System error
      - False positive - Undefined
      - False positive - User error
      - True positive - Advanced persistent threat
      - True positive - Benign
      - True positive - Benign but suspicious
      - True positive - Data exfiltration
      - True positive - Denial of service
      - True positive - Exploitation tools
      - True positive - Insider threat
      - True positive - Malware
      - True positive - Phishing attack
      - True positive - Policy violation
      - True positive - PUA/Adware
      - True positive - Ransomware
      - True positive - Unauthorized access
      - True positive - Undefined
      - Undefined
    - name: alert_ids
      description: 'A comma-separated list of UAM alert IDs.'
      required: true
      isArray: true
    name: sentinelone-update-uam-alert-verdict
    description: Updates the analyst verdict for a group of UAM alerts. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.UAMAlert.ID
      description: The UAM alert ID.
      type: String
    - contextPath: SentinelOne.UAMAlert.Updated
      description: Whether the analyst verdict was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.UAMAlert.AnalystVerdict
      description: Name of the analyst verdict performed on the alerts.
      type: String
  - arguments:
    - name: name
      required: true
      description: 'The name of the STAR rule.'
    - name: rule_severity
      required: true
      description: The rule severity.
      auto: PREDEFINED
      predefined:
      - Low
      - Medium
      - High
      - Critical
    - name: expiration_mode
      required: true
      auto: PREDEFINED
      predefined:
      - Permanent
      - Temporary
      description: Type of expiration mode.
    - name: query_type
      required: true
      auto: PREDEFINED
      predefined:
      - events
      - processes
      description: Type of the query. For now it's "events".
    - name: query
      required: true
      description: The query string for which to return events.
    - name: description
      description: The description of the STAR rule.
    - name: expiration_date
      description: If expiration mode is "Temporary" then it should be supplied, for example, "2019-08-03T04:49:26.257525Z".
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    - name: group_ids
      description: A comma-separated list of Group IDs.
      isArray: true
    - name: account_ids
      description: A comma-separated list of Account IDs.
      isArray: true
    - name: network_quarantine
      description: Whether to enable the network quarantine of the STAR rule.
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: treatAsThreat
      required: true
      auto: PREDEFINED
      predefined:
      - "Malicious"
      - "Suspicious"
      - UNDEFINED
      description: The treatAsThreat type.
    - name: query_lang
      auto: PREDEFINED
      predefined:
      - "1.0"
      - "2.0"
      description: The query language version. Supported values are "1.0" and "2.0".
    description: Creates a custom STAR rule. Relevant for API version 2.1.
    name: sentinelone-create-star-rule
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The STAR rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Name
      description: The STAR rule name.
      type: String
    - contextPath: SentinelOne.StarRule.Status
      description: The status of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Severity
      description: The severity of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Description
      description: The description of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.NetworkQuarantine
      description: The network quarantine of the STAR rule.
      type: Boolean
    - contextPath: SentinelOne.StarRule.TreatAsThreat
      description: The Treat As Threat of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationMode
      description: The expiration mode of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationDate
      description: The expiration date of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ScopeHierarchy
      description: The scope hierarchy of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.CreatedAt
      description: The created time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.UpdatedAt
      description: The updated time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.QueryLanguage
      description: The query language version for the STAR rule.
      type: String
  - arguments:
    - name: status
      description: 'A comma-separated list of the status of the STAR rule. Available options are: "Activating, Active, Deleted, Deleting, Disabled, Disabling and Draft".Example: "Draft,Active".'
    - name: creator_contains
      description: 'Free-text filter by rule creator (supports multiple values). Example: "Service Pack 1".'
    - name: queryType
      auto: PREDEFINED
      predefined:
      - events
      - processes
      description: 'Return rules with the filtered type. Example: "events".'
    - name: query
      description: 'Free-text filter by S1 query (supports multiple values). Example: "Service Pack 1".'
    - name: description_contains
      description: 'Free-text filter by rule description (supports multiple values). Example: "Service Pack 1".'
    - name: ruleIds
      description: 'A comma-separated list of Rules IDs. Example: "225494730938493804,225494730938493915".'
    - name: name_contains
      description: 'Free-text filter by rule name (supports multiple values). Example: "Service Pack 1".'
    - name: accountIds
      description: 'A comma-separated list of Account IDs to filter by. Example: "225494730938493804,225494730938493915".'
    - name: expirationMode
      auto: PREDEFINED
      predefined:
      - Temporary
      - Permanent
      description: 'Return rules with the filtered expiration mode. Example: "Permanent".'
    - name: limit
      description: 'Limit number of returned items (1-1000). Example: "10".'
    - name: siteIds
      description: 'A comma-separated list of site IDs to filter by. Example: "225494730938493804,225494730938493915".'
    description: Get a list of custom detection rules for a given scope. Relevant for API version 2.1.
    name: sentinelone-get-star-rules
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The STAR rule ID.
      type: Number
    - contextPath: SentinelOne.StarRule.Creator
      description: The STAR rule creator.
      type: string
    - contextPath: SentinelOne.StarRule.Name
      description: The STAR rule name.
      type: string
    - contextPath: SentinelOne.StarRule.Status
      description: The STAR rule status.
      type: string
    - contextPath: SentinelOne.StarRule.Severity
      description: The STAR rule severity.
      type: string
    - contextPath: SentinelOne.StarRule.GeneratedAlerts
      description: The number of STAR rule generated alerts.
      type: Number
    - contextPath: SentinelOne.StarRule.Description
      description: The STAR rule description.
      type: string
    - contextPath: SentinelOne.StarRule.StatusReason
      description: The STAR rule status reason.
      type: string
    - contextPath: SentinelOne.StarRule.ExpirationMode
      description: The STAR rule expiration mode.
      type: string
    - contextPath: SentinelOne.StarRule.ExpirationDate
      description: The STAR rule expiration date.
      type: Date
    - contextPath: SentinelOne.StarRule.Expired
      description: Whether the STAR rule expired.
      type: Boolean
  - arguments:
    - name: rule_id
      required: true
      description: 'Rule ID  Example: "225494730938493804".'
    - name: name
      required: true
      description: The name of the STAR rule.
    - name: rule_severity
      required: true
      auto: PREDEFINED
      predefined:
      - Low
      - Medium
      - High
      - Critical
      description: The rule severity.
    - name: expiration_mode
      required: true
      auto: PREDEFINED
      predefined:
      - Permanent
      - Temporary
      description: Type of expiration mode.
    - name: query_type
      required: true
      auto: PREDEFINED
      predefined:
      - events
      - processes
      description: Type of the query. For now it's "events".
    - name: query
      required: true
      description: The query string for which to return events.
    - name: description
      description: The description of the STAR rule.
    - name: expiration_date
      description: If expiration mode is "Temporary" then it should be supplied, for example, "2019-08-03T04:49:26.257525Z".
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    - name: group_ids
      description: A comma-separated list of group IDs.
      isArray: true
    - name: account_ids
      description: A comma-separated list of account IDs.
      isArray: true
    - name: network_quarantine
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable the network quarantine of the STAR rule.
    - name: treatAsThreat
      required: true
      auto: PREDEFINED
      predefined:
      - Malicious
      - Suspicious
      - UNDEFINED
      description: The treatAsThreat.
    - name: query_lang
      auto: PREDEFINED
      predefined:
      - "1.0"
      - "2.0"
      description: The query language version. Supported values are "1.0" and "2.0".
    description: Updates a custom STAR rule. Relevant for API version 2.1.
    name: sentinelone-update-star-rule
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The STAR rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Name
      description: The STAR rule name.
      type: String
    - contextPath: SentinelOne.StarRule.Status
      description: The status of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Severity
      description: The severity of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Description
      description: The description of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.NetworkQuarantine
      description: The network quarantine of the STAR rule.
      type: Boolean
    - contextPath: SentinelOne.StarRule.TreatAsThreat
      description: The Treat As Threat of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationMode
      description: The expiration mode of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationDate
      description: The expiration date of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ScopeHierarchy
      description: The scope hierarchy of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.CreatedAt
      description: The created time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.UpdatedAt
      description: The updated time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.QueryLanguage
      description: The query language version for the STAR rule.
      type: String
  - arguments:
    - name: rule_ids
      required: true
      description: A comma-separated list of STAR rule IDs.
      isArray: true
    description: Activate Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-enable-star-rules
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The Rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Enabled
      description: Whether the STAR rule was successfully enabled.
      type: Boolean
  - arguments:
    - description: A comma-separated list of STAR rule IDs.
      name: rule_ids
      required: true
      isArray: true
    description: Disable Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-disable-star-rules
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The Rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Disabled
      description: Whether the STAR rule was successfully disabled.
      type: Boolean
  - arguments:
    - description: A comma-separated list of STAR rule IDs.
      name: rule_ids
      required: true
      isArray: true
    name: sentinelone-delete-star-rule
    description: Deletes Custom Detection Rules that match the specified input filter. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The Rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Deleted
      description: Whether the STAR rule was successfully deleted.
      type: Boolean
  - arguments:
    - description: Whether the global list is accessible. (Same as `tenant` flag in API docs.).
      name: global
      auto: PREDEFINED
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of group IDs to filter by.
      name: group_ids
    - description: Comma-separated list of site IDs to filter by.
      name: site_ids
    - description: Comma-separated list of account IDs to filter by.
      name: account_ids
    - description: The number of records to skip (for paging).
      name: offset
      defaultValue: "0"
    - description: The maximum number of records to return.
      name: limit
      defaultValue: "1000"
    - description: SHA1 or SHA256 hash to search for in the blocklist.
      name: hash
    - description: SHA1 hash to search for in the blocklist.
      name: sha1
    - description: SHA256 hash to search for in the blocklist.
      name: sha256Value
    description: Retrieve the blocklist ("blacklist" in SentinelOne). You can filter by SHA1 or SHA256 hash. If the `global` flag is `true`, then group_ids, site_ids, and account_ids are ignored.
    name: sentinelone-get-blocklist
    outputs:
    - contextPath: SentinelOne.Blocklist.UserId
      description: User ID.
      type: String
    - contextPath: SentinelOne.Blocklist.UpdatedAt
      description: When entry was most recently updated.
      type: String
    - contextPath: SentinelOne.Blocklist.Value
      description: File hash (SHA1 or SHA256).
      type: String
    - contextPath: SentinelOne.Blocklist.ScopePath
      description: SentinelOne list scope.
      type: String
    - contextPath: SentinelOne.Blocklist.Type
      description: Block list type.
      type: String
    - contextPath: SentinelOne.Blocklist.Source
      description: Source of entry.
      type: String
    - contextPath: SentinelOne.Blocklist.ID
      description: Entry ID.
      type: String
    - contextPath: SentinelOne.Blocklist.CreatedAt
      description: Date entry was created.
      type: String
    - contextPath: SentinelOne.Blocklist.Description
      description: Description of the blocklist.
      type: String
    - contextPath: SentinelOne.Blocklist.OSType
      description: Operating system type block is enforced on.
      type: String
    - contextPath: SentinelOne.Blocklist.ScopeName
      description: Name of the blocklist scope.
      type: String
  - arguments:
    - description: SHA1 hash to add to the blocklist.
      name: sha1
    - description: SHA256 hash to add to the blocklist.
      name: sha256Value
    - description: String describing the source of the block.
      name: source
      defaultValue: XSOAR
    - auto: PREDEFINED
      name: os_type
      predefined:
      - windows
      - linux
      - macos
      required: true
      description: Type of operating system.
    - defaultValue: Blocked from XSOAR
      description: Note stored in SentinelOne about the block.
      name: description
    - description: Comma-separated string of site IDs to scope the blocklist.
      name: site_ids
    - description: Comma-separated string of group IDs to scope the blocklist.
      name: group_ids
    - description: Comma-separated string of account IDs to scope the blocklist.
      name: account_ids
    description: Add a hash to the blocklist in SentinelOne. Supports scoping by site, group, or account. If Scope not provided, the block will be global.
    name: sentinelone-add-hash-to-blocklist
    outputs:
    - contextPath: SentinelOne.AddHashToBlocklist.hash
      description: Hash of the file.
    - contextPath: SentinelOne.AddHashToBlocklist.status
      description: Status of the action to add a hash to the blocklist.
  - arguments:
    - description: SHA1 hash to remove from the global blocklist.
      name: sha1
    - description: SHA256 hash to remove from the global blocklist.
      name: sha256Value
    - description: Optional operating system type. If not supplied, will remove the SHA1 hash across all platforms.
      name: os_type
      auto: PREDEFINED
      predefined:
      - windows
      - macos
      - linux
    - description: Comma-separated string of site IDs to scope the blocklist.
      name: site_ids
    - description: Comma-separated string of group IDs to scope the blocklist.
      name: group_ids
    - description: Comma-separated string of account IDs to scope the blocklist.
      name: account_ids
    description: Remove a hash from the global blocklist in SentinelOne.
    name: sentinelone-remove-hash-from-blocklist
    outputs:
    - contextPath: SentinelOne.RemoveHashFromBlocklist.hash
      description: Hash of the file.
    - contextPath: SentinelOne.RemoveHashFromBlocklist.status
      description: Status of the action to remove a hash from the blocklist.
  - arguments:
    - name: agent_id
      required: true
      description: Agent ID to retrieve the file from.
    - name: file_path
      required: true
      description: File path to download the file from.
    - description: Password to protect the zip file with.
      name: password
      required: true
    description: Invokes a fetch files command against an agent endpoint.
    name: sentinelone-fetch-file
  - arguments:
    - name: agent_id
      required: true
      description: SentinelOne agent ID.
      defaultValue: Agent ID
    - name: activity_id
      required: true
      description: Activity ID in the get-activities command.
    - name: password
      required: true
      description: Password used in the sentinelone-fetch-file command.
    description: Download a file fetched using th sentinelone-fetch-file command to submit the request and the sentinelone-get-activities command to get the download path.
    name: sentinelone-download-fetched-file
  - arguments:
    - name: threat_ids
      required: true
      description: A comma-separated list of threat IDs.
      isArray: true
    - name: note
      required: true
      description: Threat Note Text.
    description: Add a threat note to one or more threats. Relevant for API version 2.1.
    name: sentinelone-write-threat-note
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Note
      description: The threat note.
      type: String
    - contextPath: SentinelOne.Threat.Status
      description: Whether the note was added successfully.
      type: String
  - arguments:
    - name: name
      required: true
      description: Threat Intelligence indicator name.
    - name: source
      required: true
      description: The source of the identified Threat Intelligence indicator.
    - name: type
      required: true
      description: The type of the Threat Intelligence indicator.
      auto: PREDEFINED
      predefined:
      - DNS
      - IPV4
      - IPV6
      - MD5
      - SHA1
      - SHA256
      - URL
    - name: method
      required: true
      description: The comparison method used by SentinelOne to trigger the event.
      auto: PREDEFINED
      predefined:
      - EQUALS
    - name: validUntil
      required: true
      description: Expiration date for the Threat Intelligence indicator.
    - name: value
      required: true
      description: The value of the Threat Intelligence indicator.
    - name: account_ids
      required: true
      description: List of account IDs to filter by.
      isArray: true
    - name: externalId
      description: The unique identifier of the indicator as provided by the Threat Intelligence source.
    - name: description
      description: Description of the Threat Intelligence indicator.
    description: Add an IoC to the Threat Intelligence database. Relevant for API version 2.1.
    name: sentinelone-create-ioc
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Name
      description: Threat Intelligence indicator name.
      type: String
    - contextPath: SentinelOne.IOC.Source
      description: The source of the identified Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Type
      description: The type of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.BatchId
      description: The IOC batch ID.
      type: String
    - contextPath: SentinelOne.IOC.Creator
      description: The IOC creator.
      type: String
    - contextPath: SentinelOne.IOC.Scope
      description: The IOC scope.
      type: String
    - contextPath: SentinelOne.IOC.ScopeId
      description: The IOC scope ID.
      type: String
    - contextPath: SentinelOne.IOC.ValidUntil
      description: Expiration date for the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Description
      description: Description of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.ExternalId
      description: The unique identifier of the indicator as provided by the Threat Intelligence source.
      type: String
    compliantpolicies:
    - Domain Blockage
    - IP Blockage
  - arguments:
    - name: entry_id
      required: true
      description: Entry ID of uploaded IOCs JSON file.
    - name: account_ids
      required: true
      description: A comma-separated list of account IDs to filter by.
      isArray: true
    description: Add bulk list of IoCs to the Threat Intelligence database. Relevant for API version 2.1.
    name: sentinelone-create-bulk-ioc
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Name
      description: Threat Intelligence indicator name.
      type: String
    - contextPath: SentinelOne.IOC.Source
      description: The source of the identified Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Type
      description: The type of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.BatchId
      description: The IOC batch ID.
      type: String
    - contextPath: SentinelOne.IOC.Creator
      description: The IOC creator.
      type: String
    - contextPath: SentinelOne.IOC.Scope
      description: The IOC scope.
      type: String
    - contextPath: SentinelOne.IOC.ScopeId
      description: The IOC scope ID.
      type: String
    - contextPath: SentinelOne.IOC.ValidUntil
      description: Expiration date for the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Description
      description: Description of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.ExternalId
      description: The unique identifier of the indicator as provided by the Threat Intelligence source.
      type: String
    compliantpolicies:
    - Domain Blockage
    - IP Blockage
  - arguments:
    - name: singularity_xdr_url
      required: true
      description: Singularity Data Lake XDR URL.
    - name: singularity_xdr_api_key
      description: A Log Read Access API key.
      required: true
    - name: query
      description: 'The query, in PowerQuery syntax.'
      required: true
    - name: start_time
      description: 'Start time for your query.'
      required: false
    - name: end_time
      description: 'End time for your query.'
      required: false
    - name: priority
      description: 'Query execution priority (defaults to "low").'
      required: false
      defaultValue: low
    - name: recurring
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Optional (defaults to false). When set to true, a materialized view of your query is created.
      required: false
      defaultValue: "false"
    - name: team_emails
      description: 'Comma-separated list of account emails to query, enabling Cross Team Search.'
      isArray: true
      required: false
    description: Run a PowerQuery, where you can pipe one or many search expressions into a set of commands to transform, manipulate, group, and summarize your data.
    name: sentinelone-run-powerquery
    outputs:
    - contextPath: SentinelOne.PowerQuery.Results.status
      description: The status of the PowerQuery execution.
      type: String
    - contextPath: SentinelOne.PowerQuery.Results.matchingEvents
      description: Number of events that match the query's initial filter.
      type: Number
    - contextPath: SentinelOne.PowerQuery.Results.omittedEvents
      description: Number of events omitted from the final result due to memory limits.
      type: Number
    - contextPath: SentinelOne.PowerQuery.Results.results
      description: A list of result rows returned by the PowerQuery, where each object represents one row (column:value pairs).
      type: List
  - arguments:
    - name: account_ids
      required: true
      description: List of account IDs to filter by.
      isArray: true
    - name: uuids
      required: true
      description: UUID of Threat Intelligence indicator.
    description: Delete an IOC from the Threat Intelligence database that matches a filter. Relevant for API version 2.1.
    name: sentinelone-delete-ioc
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Deleted
      description: Whether the Threat Intelligence indicator was deleted.
      type: Boolean
  - arguments:
    - name: account_ids
      required: true
      description: List of account IDs to filter by.
      isArray: true
    - name: limit
      description: Limit number of returned items (1-1000). Default is 1000.
    - name: upload_time_gte
      description: 'The time (greater than or equal to) at which the Threat Intelligence indicator was uploaded to the SentinelOne database. Example: "2022-07-13T20:33:29.007906Z".'
    - name: upload_time_lte
      description: 'The time (less than or equal to) at which the Threat Intelligence indicator was uploaded to the SentinelOne database. Example: "2022-07-13T20:33:29.007906Z".'
    - name: cursor
      description: 'Cursor position returned by the last request. Should be used for iterating over more than 1000 items. Example: "YWdlbnRfaWQ6NTgwMjkzODE=".'
    - name: uuids
      description: 'A list of unique IDs of the parent process of the indicator of compromise. Example: "2cffae871197f20d864fe8363eee6651".'
    - name: type
      auto: PREDEFINED
      predefined:
      - DNS
      - IPV4
      - IPV6
      - MD5
      - SHA1
      - SHA256
      - URL
      description: The type of the Threat Intelligence indicator.
    - name: batch_id
      description: 'Unique ID of the uploaded indicators batch. Example: "atmtn000000028a881bcf939dc6d92ab55443".'
    - name: source
      description: 'List of the sources of the identified Threat Intelligence indicator. Example: "AlienVault".'
    - name: value
      description: 'The value of the Threat Intelligence indicator. Example: "175.0.x.x".'
    - name: external_id
      description: 'The unique identifier of the indicator as provided by the Threat Intelligence source. Example: "e277603e-1060-5ad4-9937-c26c97f1ca68".'
    - name: name_contains
      description: 'A comma-separated list of free-text filtered by the indicator name. Example: "foo.dll".'
    - name: creator_contains
      description: 'A comma-separated list of free-text filtered by the user who uploaded the Threat Intelligence indicator. Example: "admin@sentinelone.com".'
    - name: category_in
      description: "The categories of the Threat Intelligence indicator. Example: The malware type associated with the IOC."
    - name: description_contains
      description: 'A comma-separated list of free-text filtered by the description of the indicator. Example: "Malicious-activity".'
    - name: updated_at_gte
      description: 'The time (greater or equal to) at which the indicator was last updated in the SentinelOne database. Example: "2021-07-13T20:33:29.007906Z".'
    - name: updated_at_lte
      description: 'The time (less than or equal to) at which the indicator was last updated in the SentinelOne database. Example: "2021-07-13T20:33:29.007906Z".'
    - name: creation_time_gte
      description: 'Creation time (greater than or equal to) as set by the user. Example: "2021-07-13T20:33:29.007906Z".'
    - name: creation_time_lte
      description: 'Creation time (less than or equal to) as set by the user. Example: "2021-07-13T20:33:29.007906Z".'
    description: Get the IOCs of a specified account that match the filter. Relevant for API version 2.1.
    name: sentinelone-get-iocs
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Creator
      description: Threat Intelligence indicator creator.
      type: String
    - contextPath: SentinelOne.IOC.Name
      description: Threat Intelligence indicator name.
      type: String
    - contextPath: SentinelOne.IOC.Value
      description: Threat Intelligence indicator value.
      type: String
    - contextPath: SentinelOne.IOC.Description
      description: Threat Intelligence indicator description.
      type: String
    - contextPath: SentinelOne.IOC.Type
      description: Threat Intelligence indicator type.
      type: String
    - contextPath: SentinelOne.IOC.ExternalId
      description: Threat Intelligence indicator external ID.
      type: String
    - contextPath: SentinelOne.IOC.Source
      description: Threat Intelligence indicator source.
      type: String
    - contextPath: SentinelOne.IOC.UploadTime
      description: Threat Intelligence indicator upload time.
      type: String
    - contextPath: SentinelOne.IOC.ValidUntil
      description: Threat Intelligence indicator expiration time.
      type: String
  - arguments:
    - name: query
      required: true
      description: Events matching the query search term will be returned.
    - name: from_date
      required: true
      description: Events created after this timestamp.
    - name: to_date
      required: true
      description: Events created before or at this timestamp.
    - name: limit
      description: Limit number of returned items (1-100000).
    description: Deprecated. Use ***sentinelone-get-power-query-results*** instead. Start a Deep Visibility Power query to get back status and potential results (ping afterwards using the queryId if query has not finished). Relevant for API version 2.1.
    name: sentinelone-create-power-query
    deprecated: true
  - arguments:
    - name: queryId
      required: true
      description: QueryId.
    description: Deprecated. Use ***sentinelone-get-power-query-results*** instead. Ping a Deep Visibility Power query using the queryId argument if results have not returned from an initial Power query or a previous ping. Relevant for API version 2.1.
    name: sentinelone-ping-power-query
    deprecated: true
  - arguments:
    - name: status
      required: true
      description: Incident status.
      auto: PREDEFINED
      predefined:
      - in_progress
      - resolved
      - unresolved
    - name: threat_ids
      required: true
      description: A comma-separated list of threat IDs.
      isArray: true
    description: Updates the incident status to a group of threats that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-update-threats-status
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Updated
      description: Whether the threat was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.Threat.Status
      description: Name of the status performed on the threats.
      type: String
  - arguments:
    - name: status
      required: true
      description: "Incident status."
      auto: PREDEFINED
      predefined:
      - in_progress
      - resolved
      - unresolved
    - name: alert_ids
      required: true
      description: A comma-separated list of alert IDs.
      isArray: true
    name: sentinelone-update-alerts-status
    description: Updates the incident status to a group of alerts that match the specified input filter. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: SentinelOne.Alert.Updated
      description: Whether the alert was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.Alert.Status
      description: The status performed on the alerts.
      type: String
  - arguments:
    - name: site_id
      required: true
      description: 'A valid site ID.'
    name: sentinelone-expire-site
    description: Expire the site of the given ID.
    outputs:
    - contextPath: SentinelOne.Site.ID
      description: The site ID.
      type: String
    - contextPath: SentinelOne.Site.Name
      description: The site name.
      type: String
    - contextPath: SentinelOne.Site.State
      description: The site state.
      type: String
    - contextPath: SentinelOne.Site.SKU
      description: The SKU of product features active for this site.
      type: String
    - contextPath: SentinelOne.Site.SiteType
      description: The site type.
      type: String
    - contextPath: SentinelOne.Site.Suite
      description: The site suite.
      type: String
    - contextPath: SentinelOne.Site.TotalLicenses
      description: The total licenses.
      type: String
    - contextPath: SentinelOne.Site.AccountID
      description: The account ID.
      type: String
    - contextPath: SentinelOne.Site.Creator
      description: Full name of the creating user.
      type: String
    - contextPath: SentinelOne.Site.CreatorID
      description: ID of the creating user.
      type: String
    - contextPath: SentinelOne.Site.Description
      description: Description of the site.
      type: String
    - contextPath: SentinelOne.Site.Expiration
      description: Expiration date of the site.
      type: String
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    - name: password
      required: true
      description: File encryption password. (At least 10 characters, three out of this list "uppercase", "lowercase", "digits" and "symbols" are mandatory. Maximum length is 256 characters.).
    name: sentinelone-fetch-threat-file
    description: Fetch a file associated with the threat that matches the filter.
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Downloadable
      description: Whether the file is downloadable.
      type: Boolean
    - contextPath: SentinelOne.Threat.ZippedFile
      description: Details of the zipped folder.
      type: String
  - arguments:
    - name: created_from
      required: true
      description: 'Greater than or equal to the time created. Example: "2018-02-27T04:49:26.257525Z", "10 days", "2 hours","5 months".'
    - name: created_until
      description: 'Less than or equal to the time created. Example: "2018-02-27T04:49:26.257525Z", "10 days", "2 hours","5 months".'
    - name: ruleName
      description: 'Free-text filter by rule name. Example: "rule1".'
    - name: incidentStatus
      description: 'Incident status. Example: "IN_PROGRESS".'
    - name: analystVerdict
      description: 'Analyst verdict. Example: "TRUE_POSITIVE".'
    - name: alert_ids
      description: A comma-separated list of alert IDs.
    - name: limit
      description: Limit number of returned items (1-1000). Default is 1000.
    - name: site_ids
      description: 'A comma-separated list of site IDs to filter by. Example: "225494730938493804,225494730938493915".'
    - name: cursor
      description: 'Cursor position returned by the last request. Should be used for iterating over more than 1000 items. Example: "YWdlbnRfaWQ6NTgwMjkzODE=".'
    name: sentinelone-get-alerts
    description: Get the list of alerts that matches the filter provided. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Alert.EventType
      description: Event type.
      type: String
    - contextPath: SentinelOne.Alert.RuleName
      description: The rule name.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcUser
      description: Source process user.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcName
      description: Source process name.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcPath
      description: Source process file path.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcCommandline
      description: The command line.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcSHA1
      description: Source process SHA1 file hash.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcStartTime
      description: PID start time.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcStorylineId
      description: Source process story line ID.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcName
      description: Source parent process name.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcPath
      description: Source parent process file path.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcCommandline
      description: Source parent process command line.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcStartTime
      description: PID start time.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcUser
      description: Source parent process user.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcSHA1
      description: Source parent process SHA1 file hash.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcSignerIdentity
      description: Source process file signer identity.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcSignerIdentity
      description: Source parent process file signer identity.
      type: String
    - contextPath: SentinelOne.Alert.AlertCreatedAt
      description: The the alert was created.
      type: String
    - contextPath: SentinelOne.Alert.AlertId
      description: Alert ID.
      type: String
    - contextPath: SentinelOne.Alert.AnalystVerdict
      description: Analyst verdict.
      type: String
    - contextPath: SentinelOne.Alert.IncidentStatus
      description: Incident status.
      type: String
    - contextPath: SentinelOne.Alert.EndpointName
      description: Endpoint name.
      type: String
    - contextPath: SentinelOne.Alert.AgentId
      description: Agent ID.
      type: String
    - contextPath: SentinelOne.Alert.AgentUUID
      description: Agent UUID.
      type: String
    - contextPath: SentinelOne.Alert.dvEventId
      description: Deep Visibility event ID.
      type: String
    - contextPath: SentinelOne.Alert.AgentOS
      description: Agent operating system.
      type: String
    - contextPath: SentinelOne.Alert.AgentVersion
      description: Agent version.
      type: String
    - contextPath: SentinelOne.Alert.SiteId
      description: Site ID.
      type: String
    - contextPath: SentinelOne.Alert.RuleId
      description: Rule ID.
      type: String
  - arguments:
    - name: agent_ids
      required: true
      description: "A comma-separated list of agent IDs. Example: 14629133470822878,14627455454652878."
    name: sentinelone-get-installed-applications
    description: Get the installed applications for a specific agent.
    outputs:
    - contextPath: SentinelOne.Application.Name
      description: The application name.
      type: String
    - contextPath: SentinelOne.Application.Publisher
      description: The publisher.
      type: String
    - contextPath: SentinelOne.Application.Size
      description: The size of the application in bytes.
      type: String
    - contextPath: SentinelOne.Application.Version
      description: The version of the application.
      type: String
    - contextPath: SentinelOne.Application.InstalledOn
      description: The date the application was installed.
      type: String
  - arguments:
    - name: agent_ids
      required: true
      description: "A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878."
    name: sentinelone-initiate-endpoint-scan
    description: Initiate the endpoint virus scan on provided agent IDs.
    outputs:
    - contextPath: SentinelOne.Agent.AgentID
      description: The Agent ID.
      type: String
    - contextPath: SentinelOne.Agent.Initiated
      description: Whether the scan was initiated.
      type: Boolean
  - arguments:
    - description: "A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878."
      name: agent_ids
      required: true
    description: Abort the endpoint virus scan on provided agent IDs.
    name: sentinelone-abort-endpoint-scan
    outputs:
    - contextPath: SentinelOne.Agent.AgentID
      description: The Agent ID.
      type: String
    - contextPath: SentinelOne.Agent.Aborted
      description: Whether the scan was aborted.
      type: Boolean
  - arguments:
    - name: agent_ids
      required: true
      description: "A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878."
    - name: agents_logs
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: 'Fetch Agent logs.'
      defaultValue: "true"
    - name: customer_facing_logs
      required: true
      description: Fetch customer-facing logs.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    - name: platform_logs
      required: true
      description: Actively fetch logs from the relevant platform (Windows, macOS, or Linux).
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    outputs:
    - contextPath: SentinelOne.Agent.Affected
      description: Number of affected endpoints.
      type: String
    description: Get the Agent and Endpoint logs from Agents for provided agent IDs.
    name: sentinelone-endpoint-fetch-logs
  - arguments:
    - name: item
      description: "Value of the item to be removed from the exclusion list."
      required: true
    - name: os_type
      description: OS type. Can be "windows", "windows_legacy", "macos", or "linux".
      auto: PREDEFINED
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
    - name: exclusion_type
      description: "Exclusion item type. The options are: file_type, path, white_hash, certificate, or browser."
    outputs:
    - contextPath: SentinelOne.RemoveItemFromWhitelist.status
      description: Status on if items were removed from whitelist or not found on whitelist.
      type: String
    - contextPath: SentinelOne.RemoveItemFromWhitelist.item
      description: Item removed fom whitelist.
      type: String
    description: Remove an item from the SentinelOne exclusion list.
    name: sentinelone-remove-item-from-whitelist
  - arguments:
    - name: account_ids
      isArray: true
      description: A comma-separated list of account IDs.
      required: true
    - name: output_destination
      required: true
      description: 'Output destination. Possible values: DataSetCloud/Local/None/SentinelCloud.'
      auto: PREDEFINED
      predefined:
      - DataSetCloud
      - Local
      - None
      - SentinelCloud
    - name: task_description
      required: true
      description: Task description.
    - name: script_id
      required: true
      description: Script ID.
    - name: output_directory
      description: Output directory.
    - name: agent_ids
      required: true
      description: A comma-separated list of agent IDs on which the script should run.
      isArray: true
    - name: singularity_xdr_Keyword
      description: Singularityxdr keyword.
    - name: singularity_xdr_Url
      description: Singularityxdr url.
    - name: api_key
      description: Api key.
    - name: input_params
      description: Input params.
    - name: password
      description: Password.
    - name: script_runtime_timeout_seconds
      description: Script runtime timout in seconds for current execution.
    - auto: PREDEFINED
      defaultValue: "false"
      description: If set to true, execution will require approval.
      name: requires_approval
      predefined:
      - "false"
      - "true"
    outputs:
    - contextPath: SentinelOne.RunRemoteScript.pendingExecutionId
      description: ID of the created pending execution. Present only if pending flag is true.
      type: string
    - contextPath: SentinelOne.RunRemoteScript.pending
      description: Flag indicating if the requested script execution requires approval and is created as a pending execution.
      type: boolean
    - contextPath: SentinelOne.RunRemoteScript.affected
      description: Number of entities affected by the requested operation.
      type: number
    - contextPath: SentinelOne.RunRemoteScript.parentTaskId
      description: The parent task ID of the script execution task. Null in case of pending execution.
      type: string
    description: Run a remote script that was uploaded to the SentinelOne Script Library.
    name: sentinelone-run-remote-script
  - arguments:
    - name: account_ids
      description: "A comma-separated list of account IDs. Example: '225494730938493804,225494730938493915'."
      isArray: true
    - name: computer_name_contains
      description: Free-text filter by agent computer name (supports multiple values).
    - name: count_only
      description: If true, only total number of items will be returned, without any of the actual objects.
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
    - name: created_at_gt
      description: "Created at greater than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: created_at_gte
      description: "Created at greater or equal than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: created_at_lt
      description: "Created at lesser than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: created_at_lte
      description: "Created at lesser or equal than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: cursor
      description: "Cursor position returned by the last request. Use to iterate over more than 1000 items. Example: 'YWdlbnRfaWQ6NTgwMjkzODE='."
    - name: description_contains
      description: Only include tasks with specific description.
    - name: detailed_status_contains
      description: Only include tasks with specific detailed status.
      isArray: true
    - name: group_ids
      description: "Comma-separated list of Group IDs to filter by. Example: '225494730938493804,225494730938493915'."
      isArray: true
    - name: ids
      description: "Comma-separated list of IDs to filter by. Example: '225494730938493804,225494730938493915'."
      isArray: true
    - description: Only include tasks from specific initiating user.
      name: initiated_by_contains
      isArray: true
    - description: "Limit number of returned items (1-1000). Example: '10'."
      name: limit
    - description: "Parent task ID to fetch the status by. Example: '225494730938493804'."
      name: parent_task_id
      required: true
    - description: "List of IDs to filter by."
      name: parent_task_id_in
      isArray: true
    - name: query
      description: Query.
    - name: site_ids
      isArray: true
      description: "List of site IDs to filter by. Example: '225494730938493804,225494730938493915'."
    - name: status
      description: "Status of the script task. Example: 'created'."
    - name: tenant
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Indicates a tenant scope request.
    - name: updated_at_gt
      description: "Updated at greater than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: updated_at_gte
      description: "Updated at greater or equal than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: updated_at_lt
      description: "Updated at lesser than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: updated_at_lte
      description: "Updated at lesser or equal than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: uuid_contains
      description: Free-text filter by agent UUID (supports multiple values).
    description: Get remote scripts tasks using a variety of filters.
    name: sentinelone-get-remote-script-task-status
    outputs:
    - contextPath: SentinelOne.GetRemoteScript.id
      description: ID of the task.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.accountId
      description: Account ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.accountName
      description: Account name where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentId
      description: Agent ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentIsActive
      description: The status of the agent.
      type: boolean
    - contextPath: SentinelOne.GetRemoteScript.agentMachineType
      description: Agent machine yype.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentOsType
      description: Agent operating system type.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentUuid
      description: Agent UUID.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.createdAt
      description: The script created At datetime.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.description
      description: The description of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.detailedStatus
      description: The detailed status of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.groupId
      description: Group ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.groupName
      description: Group Name where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.initiatedBy
      description: Remote script initiate by.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.initiatedById
      description: ID of the remote script initiator.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.parentTaskId
      description: Parent task ID of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.siteId
      description: Site ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.siteName
      description: Site name where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.status
      description: Status of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.statusCode
      description: Status code of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.statusDescription
      description: Status description of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.type
      description: Type of remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.updateAt
      description: Remote script upated at.
      type: string
  - arguments:
    - name: computer_names
      description: A comma-separated list of partial or whole computer names, which ran scripts, to get a download link for.
      isArray: true
    - name: task_ids
      description: A comma-separated list of task IDs to get a download link for.
      isArray: true
      required: true
    description: Get a script's result download URL.
    name: sentinelone-get-remote-script-task-results
    outputs:
    - contextPath: SentinelOne.RemoteScriptResults.taskId
      description: ID of the task.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.fileName
      description: File name.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.downloadUrl
      description: Download URL.
      type: string
  - arguments:
    - name: account_ids
      required: true
      description: A comma-separated list of account IDs.
      isArray: true
    - name: output_destination
      required: true
      auto: PREDEFINED
      predefined:
      - DataSetCloud
      - Local
      - None
      - SentinelCloud
      description: Output destination.
    - name: task_description
      required: true
      description: Task description.
    - name: script_id
      required: true
      description: Script ID.
    - name: output_directory
      description: Output directory.
    - name: agent_ids
      required: true
      description: A comma-separated list of agent IDs on which the script should run.
      isArray: true
    - name: singularity_xdr_Keyword
      description: Singularity XDR keyword.
    - name: singularity_xdr_Url
      description: Singularity XDR URL.
    - name: api_key
      description: API key.
    - name: input_params
      description: Input parameters.
    - name: password
      description: Password.
    - name: script_runtime_timeout_seconds
      description: Script runtime timout in seconds for current execution.
    - auto: PREDEFINED
      defaultValue: "false"
      description: If set to true, execution will require approval.
      name: requires_approval
      predefined:
      - "false"
      - "true"
    - defaultValue: '60'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds.
      name: interval
    - defaultValue: '600'
      description: Indicates the time in seconds until the polling sequence timeouts.
      name: timeout
    - description: "Parent task ID to fetch the status by. Example: '225494730938493804'."
      name: parent_task_id
    description: Automate a remote script's execution cycle and return the script's results.
    name: sentinelone-remote-script-automate-results
    outputs:
    - contextPath: SentinelOne.RemoteScriptResults.taskId
      description: ID of the task.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.fileName
      description: File name.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.downloadUrl
      description: Download URL.
      type: string
    polling: true
  - arguments:
    - name: account_ids
      description: A comma-separated list of account IDs.
      isArray: true
    - name: site_ids
      description: A comma-separated list of site IDs on which the query should run.
      isArray: true
    - name: query
      required: true
      description: Events matching the query search term will be returned.
    - name: from_date
      required: true
      description: "Events created after this date. Example: '2018-02-27T04:49:26.257525Z'."
    - name: to_date
      required: true
      description: "Events created before or at this date. Example: '2018-02-27T04:49:26.257525Z'."
    - name: limit
      description: Limit number of returned items (1-100000).
    - defaultValue: '10'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds.
      name: interval
    - defaultValue: '300'
      description: Indicates the time in seconds until the polling sequence timeouts.
      name: timeout
    - name: query_id
      description: "QueryId. Example: pq3be5e2747f716cxxxxxxxxxxxxx20a0."
    description: Automate a power query and return the query results. (The maximum timeout of 300 seconds is allowed.)
    name: sentinelone-get-power-query-results
    outputs:
    - contextPath: SentinelOne.PowerQuery.ResultIndex
      description: Result from the power query in list of objects format.
      type: List
    polling: true
  - arguments: []
    description: Returns the list of fields for an incident type.
    name: get-mapping-fields
  - arguments: []
    description: Pushes local changes to the remote system.
    name: update-remote-system
  - arguments:
    - description: 'The ticket ID.'
      name: id
      required: true
    - description: Retrieve entries that were created after lastUpdate.
      name: lastUpdate
      required: true
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
    name: get-remote-data
  - arguments:
    - description: Retrieve entries that were created after lastUpdate.
      name: last_update
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
    name: get-modified-remote-data
  - arguments:
    - description: 'The queryId that is returned when creating a query under Create Query. Example: "q1xx2xx3". Get the query_id from the "get-query-id" command.'
      name: query_id
      required: true
    description: Returns status of a Deep Visibility Query.
    name: sentinelone-get-dv-query-status
    outputs:
    - contextPath: SentinelOne.Query.Status.progressStatus
      description: Progress Query Status.
    - contextPath: SentinelOne.Query.Status.queryModeInfo.lastActivatedAt
      description: Last Activated At.
    - contextPath: SentinelOne.Query.Status.queryModeInfo.mode
      description: Query Mode.
    - contextPath: SentinelOne.Query.Status.responseState
      description: State of the Query.
    - contextPath: SentinelOne.Query.Status.warnings
      description: Warnings during Query.
    - contextPath: SentinelOne.Query.Status.QueryId
      description: QueryID From Request.
  - arguments:
    - name: agent_id
      description: AgentId of the System.
      required: true
    description: Returns network interface details for a given Agent ID. This includes MAC address details and interface description.
    name: sentinelone-get-agent-mac
    outputs:
    - contextPath: SentinelOne.MAC
      description: Agent network interface details.
    - contextPath: SentinelOne.MAC.agent_id
      description: AgentID.
    - contextPath: SentinelOne.MAC.hostname
      description: Hostname.
    - contextPath: SentinelOne.MAC.int_name
      description: Interface Name.
    - contextPath: SentinelOne.MAC.ip
      description: IP Address.
    - contextPath: SentinelOne.MAC.mac
      description: MAC Address.
  - arguments:
    - name: account_id
      description: Can filter on one account ID. Otherwise, it returns information from all accounts.
      required: false
    description: Returns details of accounts.
    name: sentinelone-get-accounts
    outputs:
    - contextPath: SentinelOne.Accounts.AccountType
      description: The account type.
      type: string
    - contextPath: SentinelOne.Accounts.ActiveAgents
      description: The account number of active agents.
      type: number
    - contextPath: SentinelOne.Accounts.NumberOfSites
      description: The account number of sites.
      type: number
    - contextPath: SentinelOne.Accounts.State
      description: The account state.
      type: string
    - contextPath: SentinelOne.Accounts.CreatedAt
      description: The account creation date.
      type: string
    - contextPath: SentinelOne.Accounts.Expiration
      description: The account expiration date.
      type: string
    - contextPath: SentinelOne.Accounts.ID
      description: The account ID.
      type: string
    - contextPath: SentinelOne.Accounts.Name
      description: The account name.
      type: string
  - arguments:
    - description: A comma-separated list of account IDs.
      name: account_ids
      isArray: true
    - name: application_catalog_id
      description: Filter results by application catalog id.
    - name: creator_contains
      description: Free-text filter by application creator.
    - name: ids
      description: A comma-separated list of applications IDs.
      isArray: true
    - name: name_contains
      description: Free-text filter by application name.
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    description: Returns all installed singularity marketplace applications that match the specified filter values.
    name: sentinelone-list-installed-singularity-marketplace-applications
    outputs:
    - contextPath: SentinelOne.InstalledApps.ID
      description: The application ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.Account
      description: The account name.
      type: string
    - contextPath: SentinelOne.InstalledApps.AccountId
      description: The account ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ApplicationCatalogId
      description: The application Catalog ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ApplicationCatalogName
      description: The application Catalog name.
      type: string
    - contextPath: SentinelOne.InstalledApps.AlertMessage
      description: The alert message.
      type: string
    - contextPath: SentinelOne.InstalledApps.CreatedAt
      description: Application created at.
      type: date
    - contextPath: SentinelOne.InstalledApps.Creator
      description: Application creator.
      type: string
    - contextPath: SentinelOne.InstalledApps.CreatorId
      description: Application creator ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.DesiredStatus
      description: Application desired status.
      type: string
    - contextPath: SentinelOne.InstalledApps.HasAlert
      description: Application has alert.
      type: boolean
    - contextPath: SentinelOne.InstalledApps.LastEntityCreatedAt
      description: Application last entity created at.
      type: date
    - contextPath: SentinelOne.InstalledApps.Modifier
      description: Modifier.
      type: string
    - contextPath: SentinelOne.InstalledApps.ModifierId
      description: Modifier ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ScopeId
      description: The scope ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ScopeLevel
      description: The scope level.
      type: string
    - contextPath: SentinelOne.InstalledApps.Status
      description: Status of application.
      type: string
    - contextPath: SentinelOne.InstalledApps.UpdatedAt
      description: Application updated at.
      type: string
    - contextPath: SentinelOne.InstalledApps.ApplicationInstanceName
      description: Application instance name.
      type: string
  - arguments:
    - name: account_ids
      description: "A comma-separated list of account IDs."
      isArray: true
    - name: role_ids
      description: A comma-separated list of rbac roles to filter by.
      isArray: true
    - name: ids
      description: A comma-separated list of service user IDs to filter by.
      isArray: true
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    name: sentinelone-get-service-users
    description: Returns all service users that match the specified filter values.
    outputs:
    - contextPath: SentinelOne.ServiceUsers.ID
      description: The service user ID.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ApiTokenCreatedAt
      description: Api token created at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.ApiTokenExpiresAt
      description: Api token expires at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.CreatedAt
      description: Service user created at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.CreatedById
      description: The service user created by Id.
      type: string
    - contextPath: SentinelOne.ServiceUsers.CreatedByName
      description: The service user created by name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.Description
      description: Service user description.
      type: string
    - contextPath: SentinelOne.ServiceUsers.LastActivation
      description: Last activation date.
      type: date
    - contextPath: SentinelOne.ServiceUsers.Name
      description: Service user name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.Scope
      description: Service user scope.
      type: string
    - contextPath: SentinelOne.ServiceUsers.UpdatedAt
      description: Service user updated at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.UpdatedById
      description: Service user updated by Id.
      type: string
    - contextPath: SentinelOne.ServiceUsers.UpdatedByName
      description: Service user updated by name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesRoleId
      description: Scope roles role Id.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesRoleName
      description: Scope roles role name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesAccountName
      description: Scope roles account name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesId
      description: Scope roles Id.
      type: string
  - arguments:
    - description: The ID of the threat.
      name: threat_id
      required: true
    description: Returns threat notes.
    name: sentinelone-get-threat-notes
    outputs:
    - contextPath: SentinelOne.Notes.CreatedAt
      description: The note creation date.
      type: string
    - contextPath: SentinelOne.Notes.Creator
      description: The note creator.
      type: string
    - contextPath: SentinelOne.Notes.CreatorID
      description: The note creator ID.
      type: string
    - contextPath: SentinelOne.Notes.Edited
      description: Whether the note was edited or not.
      type: boolean
    - contextPath: SentinelOne.Notes.ID
      description: The note ID.
      type: string
    - contextPath: SentinelOne.Notes.Text
      description: The note text.
      type: string
    - contextPath: SentinelOne.Notes.UpdatedAt
      description: The note updated time.
      type: string
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    name: sentinelone-threat-download-from-cloud
    description: Download a file associated with the threat from the Cloud (BinaryVault).
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Downloadable
      description: Whether the file is downloadable.
      type: Boolean
    - contextPath: SentinelOne.Threat.ZippedFile
      description: Details of the zipped folder.
      type: String
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    - name: limit
      required: false
      description: "The max number of timeline entries to return, default is 5000."
    name: sentinelone-export-full-threat-timeline
    description: Exports the threat's full timeline as a JSON File. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Export.Timeline.ThreatId
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Export.Timeline.Filename
      description: The name of the file containing the Timeline.
      type: Boolean
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    name: sentinelone-export-threat-events
    description: Exports the threat's events as a JSON File. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Export.Events.ThreatId
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Export.Events.Filename
      description: The name of the file containing the Timeline.
      type: Boolean
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: ""
  type: python
  subtype: python3
tests:
- SentinelOne V2.1 - Test
- SentinelOne V2.0 - Test
fromversion: 5.0.0
defaultclassifier: SentinelOne Classifier
defaultmapperin: SentinelOne Incoming Mapper
defaultmapperout: SentinelOne - Outgoing Mapper