SentinelOne Deprecated

commonfields:
  id: SentinelOne
  version: -1
name: SentinelOne
display: SentinelOne (Deprecated)
deprecated: true
fromversion: 5.0.0
category: Endpoint
provider: SentinelOne
description: Deprecated. Use the SentinelOne v2 integration instead.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
- display: API Version
  name: version
  defaultvalue: "2.0"
  type: 0
  required: false
- display: Token
  name: token
  defaultvalue: ""
  type: 4
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: so-activities
    arguments:
    - name: activity_type__in
      description: Activity types list (by comma separator)
    - name: activity_type__nin
      description: Excluded Activity types list (by comma separator).
    - name: created_at__lt
      description: Reported date (less than).
    - name: created_at__gt
      description: Reported date (greater than).
    - name: created_at__lte
      description: Reported date (less than or equal).
    - name: created_at__gte
      description: Reported date (greater than or equal).
    - name: skip
      description: Skip a number of items.
    - name: limit
      description: Limit a number of items in the query.
    outputs:
    - contextPath: SentinelOne.Activities.CreatedAt
      description: Activity creation time
    - contextPath: SentinelOne.Activities.OsFamily
      description: OS family
    - contextPath: SentinelOne.Activities.User
      description: Created by user
    - contextPath: SentinelOne.Activities.UserId
      description: Created by user id
    - contextPath: SentinelOne.Activities.Group
      description: Group
    - contextPath: SentinelOne.Activities.Id
      description: Activity id
    - contextPath: SentinelOne.Activities.MitigationPolicyCommand
      description: Mitigation Policy Command
    - contextPath: SentinelOne.Activities.AgentId
      description: Agent
    - contextPath: SentinelOne.Activities.Hash
      description: Hash
    - contextPath: SentinelOne.Activities.Description
      description: Activity description
    - contextPath: SentinelOne.Activities.ThreatId
      description: Threat Id
    description: commands.server.so.commands.activities.description
  - name: so-count-by-filters
    arguments:
    - name: participating_fields
      description: Which fields to get counts for. Allowed values software_information__os_type software_information__os_arch hardware_information__machine_type network_information__domain network_status configuration__learning_mode is_pending_uninstall is_up_to_date infected policy_id is_active
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than)
    - name: created_at__gt
      description: Created date (greater than)
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than)
    - name: last_active_date__lt
      description: Last active date (less than)
    - name: last_active_date__gt
      description: Last active date (greater than)
    - name: total_memory__lte
      description: Total memory (less than or equal)
    - name: total_memory__gte
      description: Total memory (greater than or equal)
    - name: core_count__lte
      description: Cores count (less than or equal)
    - name: core_count__gte
      description: Cores count (greater than or equal)
    - name: cpu_count__lte
      description: CPU count (less than or equal)
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Is agent decommissioned
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains)
    - name: agent_version__in
      description: Agent with any of given versions (contains)
    - name: os_type__in
      description: Agent of specific os type (contains)
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type
    - name: machine_type__in
      description: Agent of specific machine type (contains)
    - name: domain__in
      description: Agent of a specific domain (contains)
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query
    - name: network_status
      description: The agent network status
    description: Count agent by filters
  - name: so-agents-count
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Count agents
  - name: so-agent-decommission
    arguments:
    - name: agent_id
      required: true
      default: true
      description: The agent id
    description: Decommission agent
  - name: so-get-agent
    arguments:
    - name: agent_id
      required: true
      default: true
      description: The agent id
    description: Get agent
  - name: so-agents-query
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    outputs:
    - contextPath: SentinelOne.Agents.NetworkStatus
      description: The agent network status
    - contextPath: SentinelOne.Agents.Id
      description: The agent ID
    - contextPath: SentinelOne.Agents.GroupId
      description: The agent group ID
    - contextPath: SentinelOne.Agents.AgentVersion
      description: The agent software version
    - contextPath: SentinelOne.Agents.IsPendingUninstall
      description: Is the agent pending uninstall
    - contextPath: SentinelOne.Agents.IsUninstalled
      description: Is the agent uninstalled
    - contextPath: SentinelOne.Agents.IsDecomissioned
      description: Is the agent decommissioned
    - contextPath: SentinelOne.Agents.IsActive
      description: Is the agent active
    - contextPath: SentinelOne.Agents.LastActiveDate
      description: The last active date of the agent
    - contextPath: SentinelOne.Agents.RegisteredAt
      description: The registration date of the agent
    - contextPath: SentinelOne.Agents.Uuid
      description: UUID of the agent
    - contextPath: SentinelOne.Agents.ExternalIp
      description: The agent IP address
    - contextPath: SentinelOne.Agents.GroupIp
      description: The agent group IP
    - contextPath: SentinelOne.Agents.IsUpToDate
      description: Is the agent software up to date
    - contextPath: SentinelOne.Agents.ThreatCount
      description: Number of active threats
    - contextPath: SentinelOne.Agents.EncryptedApplications
      description: Is disk encryption on
    - contextPath: SentinelOne.Agents.OsName
      description: Name of operation system
    - contextPath: SentinelOne.Agents.ComputerName
      description: Name of agent computer
    - contextPath: SentinelOne.Agents.Domain
      description: Domain name of agent
    - contextPath: SentinelOne.Agents.Interfaces
      description: Network interfaces
    - contextPath: SentinelOne.Agents.Configuration
      description: The agent configuration
    - contextPath: SentinelOne.Agents.CreatedAt
      description: Agent creation time
    - contextPath: SentinelOne.Agents.UpdatedAt
      description: Agent update time
    description: Agents list and search
  - name: so-get-agent-processes
    arguments:
    - name: agent_id
      required: true
      default: true
      description: The agent id.
    description: Get agent proccesses
  - name: so-agent-recommission
    arguments:
    - name: agent_id
      required: true
      default: true
      description: The agent id.
    description: Recommission agent
  - name: so-agent-unquarentine
    arguments:
    - name: agent_id
      required: true
      description: The agent id.
    description: Reconnect agent network
  - name: so-agent-shutdown
    arguments:
    - name: agent_id
      required: true
      description: The agent id.
    description: Shutdown agent
  - name: so-agent-uninstall
    arguments:
    - name: agent_id
      required: true
      description: The agent id.
    description: uninstall agent
  - name: so-agents-broadcast
    arguments:
    - name: message
      required: true
      description: The broadcast message to send
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Boadcast
  - name: so-agents-connect
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Connect to network
  - name: so-agent-quarentine
    arguments:
    - name: agent_id
      required: true
      description: The agent id.
    description: Connect to network
  - name: so-agents-decommission
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Decommission
  - name: so-agents-disconnect
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Disconnect From Network
  - name: so-agents-fetch-logs
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Fetch log
  - name: so-agents-shutdown
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Shutdown agents
  - name: so-agents-uninstall
    arguments:
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: Agent of specific os type.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Uninsatll agents
  - name: so-agents-upgrade-software
    arguments:
    - name: use_recent
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Flag for use recent uploaded package.
    - name: package_name
      required: true
      description: File name for recent uploaded package.
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: created_at__lt
      description: Created date (less than).
    - name: created_at__gt
      description: Created date (greater than).
    - name: registered_at__lt
      description: Registered date (less than).
    - name: registerd_at__gt
      description: Registered date (greater than).
    - name: last_active_date__lt
      description: Last active date (less than).
    - name: last_active_date__gt
      description: Last active date (greater than).
    - name: total_memory__lte
      description: Total memory (less than or equal).
    - name: total_memory__gte
      description: Total memory (greater than or equal).
    - name: core_count__lte
      description: Cores count (less than or equal).
    - name: core_count__gte
      description: Cores count (greater than or equal).
    - name: cpu_count__lte
      description: CPU count (less than or equal).
    - name: cpu_count__gte
      description: CPU count (greater than or equal)
    - name: is_active
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent status.
    - name: infected
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent infection status.
    - name: is_pending_uninstall
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent with pending uninstall requests.
    - name: include_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: enable the ability to query on each agents that ever subscribed (decommission or commissioned).
    - name: is_decommissioned
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is decommissioned agent.
    - name: is_uninstalled
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: is uninstalled agent
    - name: is_up_to_date
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent version status
    - name: encrypted_applications
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Agent disk encryption status
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    - name: group_id
      description: Related group id.
    - name: group_id__in
      description: Group ids list (by comma separator)
    - name: policy_id__in
      description: Policy ids list (by comma separator)
    - name: computer_name__like
      description: Agent computer name (contains).
    - name: agent_version__in
      description: Agent with any of given versions (contains).
    - name: os_type__in
      description: Agent of specific os type (contains).
    - name: os_type
      required: true
      auto: PREDEFINED
      predefined:
      - unknown
      - osx
      - windows
      - android
      - linux
      description: OS type for desired update.
    - name: machine_type__in
      description: Agent of specific machine type (contains).
    - name: domain__in
      description: Agent of a specific domain (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    - name: network_status
      description: The agent network status
    description: Upgrade agents software
  - name: so-create-exclusion-list
    arguments:
    - name: name
      required: true
      description: The list name
    outputs:
    - contextPath: SentinelOne.ExclusionLists.CreateExclusionList.Id
      description: The list id.
    - contextPath: SentinelOne.ExclusionLists.CreateExclusionList.Name
      description: The list name.
    - contextPath: SentinelOne.ExclusionLists.CreateExclusionList.CreatedAt
      description: The time the list was created.
    - contextPath: SentinelOne.ExclusionLists.CreateExclusionList.UpdatedAt
      description: The last time the list was updated.
    description: Create exclusion list
  - name: so-delete-exclusion-list
    arguments:
    - name: list_id
      required: true
      description: The list id
    description: Delete exclusion list
  - name: so-get-exclusion-list
    arguments:
    - name: list_id
      required: true
      description: The list id
    outputs:
    - contextPath: SentinelOne.ExclusionLists.GetExclusionList.Id
      description: The list id.
    - contextPath: SentinelOne.ExclusionLists.GetExclusionList.Name
      description: The list name.
    - contextPath: SentinelOne.ExclusionLists.GetExclusionList.CreatedAt
      description: The time the list was created.
    - contextPath: SentinelOne.ExclusionLists.GetExclusionList.UpdatedAt
      description: The last time the list was updated.
    description: Get exclusion list
  - name: so-get-exclusion-lists
    arguments: []
    outputs:
    - contextPath: SentinelOne.ExclusionLists.GetExclusionLists.Id
      description: The list id.
    - contextPath: SentinelOne.ExclusionLists.GetExclusionLists.Name
      description: The list name.
    - contextPath: SentinelOne.ExclusionLists.GetExclusionLists.CreatedAt
      description: The time the list was created.
    - contextPath: SentinelOne.ExclusionLists.GetExclusionLists.UpdatedAt
      description: The last time the list was updated.
    description: Get exclusion lists
  - name: so-update-exclusion-list
    arguments:
    - name: list_id
      required: true
      description: The list id
    - name: name
      required: true
      description: The group name
    description: Update exclusion list
  - name: so-get-groups
    arguments:
    - name: policy_id
      required: true
      description: The group policy id.
    outputs:
    - contextPath: SentinelOne.Groups.GetGroups.Id
      description: The group id.
    - contextPath: SentinelOne.Groups.GetGroups.Name
      description: The group name.
    - contextPath: SentinelOne.Groups.GetGroups.PolicyId
      description: The group policy id
    - contextPath: SentinelOne.Groups.GetGroups.FilterId
      description: The group filter id
    - contextPath: SentinelOne.Groups.GetGroups.UserId
      description: The user id who created the group.
    - contextPath: SentinelOne.Groups.GetGroups.IsDefault
      description: Flag for catch-all group.
    - contextPath: SentinelOne.Groups.GetGroups.CreatedAt
      description: The time the group was created.
    - contextPath: SentinelOne.Groups.GetGroups.UpdatedAt
      description: The last time the group was updated.
    - contextPath: SentinelOne.Groups.GetGroups.Source
      description: The group source
    - contextPath: SentinelOne.Groups.GetGroups.AdQuery
      description: AD query
    description: Get groups
  - name: so-create-group
    arguments:
    - name: name
      required: true
      description: The group name.
    - name: policy_id
      description: The group policy id.
    - name: ad_query
      required: true
      description: The dynamic group ad query.
    - name: rank
      required: true
      description: The group ramk
    outputs:
    - contextPath: SentinelOne.Groups.CreateGroups.Id
      description: The group id.
    - contextPath: SentinelOne.Groups.CreateGroups.Name
      description: The group name.
    - contextPath: SentinelOne.Groups.CreateGroups.PolicyId
      description: The group policy id
    - contextPath: SentinelOne.Groups.CreateGroups.FilterId
      description: The group filter id
    - contextPath: SentinelOne.Groups.CreateGroups.UserId
      description: The user id who created the group.
    - contextPath: SentinelOne.Groups.CreateGroups.IsDefault
      description: Flag for catch-all group.
    - contextPath: SentinelOne.Groups.CreateGroups.CreatedAt
      description: The time the group was created.
    - contextPath: SentinelOne.Groups.CreateGroups.UpdatedAt
      description: The last time the group was updated.
    - contextPath: SentinelOne.Groups.CreateGroups.Source
      description: The group source
    - contextPath: SentinelOne.Groups.CreateGroups.AdQuery
      description: AD query
    description: Create groups
  - name: so-get-group
    arguments:
    - name: group_id
      required: true
      description: The group id.
    outputs:
    - contextPath: SentinelOne.Groups.GetGroup.Id
      description: The group id.
    - contextPath: SentinelOne.Groups.GetGroup.Name
      description: The group name.
    - contextPath: SentinelOne.Groups.GetGroup.PolicyId
      description: The group policy id
    - contextPath: SentinelOne.Groups.GetGroup.FilterId
      description: The group filter id
    - contextPath: SentinelOne.Groups.GetGroup.UserId
      description: The user id who created the group.
    - contextPath: SentinelOne.Groups.GetGroup.IsDefault
      description: Flag for catch-all group.
    - contextPath: SentinelOne.Groups.GetGroup.CreatedAt
      description: The time the group was created.
    - contextPath: SentinelOne.Groups.GetGroup.UpdatedAt
      description: The last time the group was updated.
    - contextPath: SentinelOne.Groups.GetGroup.Source
      description: The group source
    - contextPath: SentinelOne.Groups.GetGroup.AdQuery
      description: AD query
    description: Get groups
  - name: so-update-group
    arguments:
    - name: group_id
      required: true
      description: The group id.
    - name: name
      required: true
      description: The group name.
    - name: policy_id
      required: true
      description: The group policy id.
    - name: ad_query
      description: The dynamic group ad query.
    - name: rank
      required: true
      description: The group ramk
    - name: filter_id
      required: true
      description: The filter id
    outputs:
    - contextPath: SentinelOne.Groups.UpdateGroup.Id
      description: The group id.
    - contextPath: SentinelOne.Groups.UpdateGroup.Name
      description: The group name.
    - contextPath: SentinelOne.Groups.UpdateGroup.PolicyId
      description: The group policy id
    - contextPath: SentinelOne.Groups.UpdateGroup.FilterId
      description: The group filter id
    - contextPath: SentinelOne.Groups.UpdateGroup.UserId
      description: The user id who created the group.
    - contextPath: SentinelOne.Groups.UpdateGroup.IsDefault
      description: Flag for catch-all group.
    - contextPath: SentinelOne.Groups.UpdateGroup.CreatedAt
      description: The time the group was created.
    - contextPath: SentinelOne.Groups.UpdateGroup.UpdatedAt
      description: The last time the group was updated.
    - contextPath: SentinelOne.Groups.UpdateGroup.Source
      description: The group source
    - contextPath: SentinelOne.Groups.UpdateGroup.AdQuery
      description: AD query
    description: Update groups
  - name: so-delete-group
    arguments:
    - name: group_id
      required: true
      description: The group id.
    description: Delete groups
  - name: so-add-agent-to-group
    arguments:
    - name: group_id
      required: true
      description: The group id.
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: id__in
      description: Agents ids list (by comma separator)
    - name: id__nin
      description: Excluded agents ids list (by comma separator)
    description: Add agent to groups
  - name: so-set-cloud-intelligence
    arguments:
    - name: cloud_intelligence_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Cloud intelligence mode
    - name: global_two_fa_enabled
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Global two factor authentication mode
    - name: remember_me_length
      required: true
      description: Remember logged in user duration in days
    description: Update
  - name: so-create-hash
    arguments:
    - name: hash
      required: true
      description: The content hash.
    - name: os_family
      required: true
      auto: PREDEFINED
      predefined:
      - osx
      - windows
      - linux
      - android
      description: Threat's operation system.
    - name: is_black
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Is black hash
    - name: description
      required: true
      description: The hash description.
    outputs:
    - contextPath: SentinelOne.Hashes.CreateHash.Hash
      description: The content hash.
    - contextPath: SentinelOne.Hashes.CreateHash.OsFamily
      description: Threat's operation system
    - contextPath: SentinelOne.Hashes.CreateHash.IsBlack
      description: Is black hash
    - contextPath: SentinelOne.Hashes.CreateHash.Description
      description: The hash description.
    description: Create hash.
  - name: so-delete-hash
    arguments:
    - name: hash_id
      required: true
      description: The hash id.
    description: Delete hash
  - name: so-get-hash-reputation
    arguments:
    - name: hash_id
      required: true
      description: The hash id.
    description: Get hash reputation.
  - name: so-get-hash
    arguments:
    - name: hash_id
      required: true
      description: The hash id.
    outputs:
    - contextPath: SentinelOne.Hashes.GetHash.Hash
      description: The content hash.
    - contextPath: SentinelOne.Hashes.GetHash.OsFamily
      description: Threat's operation system
    - contextPath: SentinelOne.Hashes.GetHash.IsBlack
      description: Is black hash
    - contextPath: SentinelOne.Hashes.GetHash.Description
      description: The hash description.
    description: Get hash reputation.
  - name: so-get-hashes
    arguments:
    - name: created_at__lt
      description: System creation date (less than).
    - name: created_at__gt
      description: System creation date (greater than).
    - name: updated_at__lt
      description: ystem update date (less than).
    - name: updated_at__gt
      description: System update date (greater than).
    - name: os_family
      auto: PREDEFINED
      predefined:
      - osx
      - windows
      - linux
      - android
      description: Threat's operation system.
    - name: is_black
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Is black hash
    - name: query
      description: Free text search on Agent's network computer name, IP & Mac addresses, Domain and Group name, and agent version (contains).
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query.
    description: Get hash reputation.
  - name: so-update-hash
    arguments:
    - name: hash
      required: true
      description: The content hash.
    - name: os_family
      required: true
      auto: PREDEFINED
      predefined:
      - osx
      - windows
      - linux
      - android
      description: Threat's operation system.
    - name: is_black
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Is black hash
    - name: description
      required: true
      description: The hash description.
    description: Create hash.
  - name: so-get-policies
    arguments: []
    description: Get Policies list.
  - name: so-create-policy
    arguments:
    - name: name
      required: true
      description: The policy name.
    - name: cloud_validation_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Cloud validation mode on/off.
    - name: auto_mitigation_action
      required: true
      auto: PREDEFINED
      predefined:
      - mitigation.none
      - mitigation.killThreat
      - mitigation.quarantineThreat
      - mitigation.remediateThreat
      - mitigation.rollbackThreat
      description: The automatic mitigation action.
    - name: network_quarantine_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Automatic network quarantine on/off.
    - name: auto_immune_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Automatic immune on/off.
    - name: auto_decommission_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Automatic decommission on/off.
    - name: auto_decommission_days
      required: true
      description: Automatic decommission period in days.
    - name: research_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Share data with SentinelOne.
    - name: show_suspicious_on
      required: true
      description: Show suspicious activities
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    description: Create Policy.
  - name: so-get-policy
    arguments:
    - name: policy_id
      required: true
      description: The policy id.
    description: Get policy
  - name: so-update-policy
    arguments:
    - name: policy_id
      required: true
      description: The policy id.
    - name: name
      required: true
      description: The policy name.
    - name: cloud_validation_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Cloud validation mode on/off.
    - name: auto_mitigation_action
      required: true
      auto: PREDEFINED
      predefined:
      - mitigation.none
      - mitigation.killThreat
      - mitigation.quarantineThreat
      - mitigation.remediateThreat
      - mitigation.rollbackThreat
      description: The automatic mitigation action.
    - name: network_quarantine_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Automatic network quarantine on/off.
    - name: auto_immune
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Automatic immune on/off.
    - name: auto_decommission_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Automatic decommission on/off.
    - name: auto_decommission_days
      required: true
      description: Automatic decommission period in days.
    - name: research_on
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Share data with SentinelOne.
    description: Create Policy.
  - name: so-delete-policy
    arguments:
    - name: policy_id
      required: true
      description: The policy id.
    description: Delete policy
  - name: so-get-threat
    arguments:
    - name: threat_id
      required: true
      description: The threat id.
    outputs:
    - contextPath: SentinelOne.Threats.GetThreat.ThreatId
      description: The threat id.
    - contextPath: SentinelOne.Threats.GetThreat.Agent
      description: Affected agent id
    - contextPath: SentinelOne.Threats.GetThreat.AgentVersion
      description: The agent software version.
    - contextPath: SentinelOne.Threats.GetThreat.CreatedDate
      description: The occurrence date.
    - contextPath: SentinelOne.Threats.GetThreat.Description
      description: The threat description.
    - contextPath: SentinelOne.Threats.GetThreat.SilentThreat
      description: Silent threat.
    - contextPath: SentinelOne.Threats.GetThreat.InQuarantine
      description: Quarantined threat.
    - contextPath: SentinelOne.Threats.GetThreat.InLearningMode
      description: Learning mode threat.
    - contextPath: SentinelOne.Threats.GetThreat.Resolved
      description: Resolved threat.
    - contextPath: SentinelOne.Threats.GetThreat.Hidden
      description: Hidden threat.
    - contextPath: SentinelOne.Threats.GetThreat.Suspicious
      description: Suspicious threat.
    - contextPath: SentinelOne.Threats.GetThreat.LearningMode
      description: Learning mode threat.
    - contextPath: SentinelOne.Threats.GetThreat.MitigationActions
      description: List of mitigation actions.
    - contextPath: SentinelOne.Threats.GetThreat.MitigationResults
      description: Mitigation results.
    - contextPath: SentinelOne.Threats.GetThreat.MitigationStatus
      description: Threat status.
    - contextPath: SentinelOne.Threats.GetThreat.KillSuccess
      description: Threat killed report status.
    - contextPath: SentinelOne.Threats.GetThreat.QuarantineStatus
      description: Threat quarantine report status.
    - contextPath: SentinelOne.Threats.GetThreat.RemediateStatus
      description: Threat remediate report status.
    - contextPath: SentinelOne.Threats.GetThreat.RollbackStatus
      description: Threat rollback report status.
    - contextPath: SentinelOne.Threats.GetThreat.NetworkQuarantineStatus
      description: Agent quarantine report status.
    - contextPath: SentinelOne.Threats.GetThreat.AffectedFiles
      description: affected_files.
    - contextPath: SentinelOne.Threats.GetThreat.MaliciousGroupId
      description: The file group id
    - contextPath: SentinelOne.Threats.GetThreat.FileId
      description: The file object id
    - contextPath: SentinelOne.Threats.GetThreat.FilePermission
      description: The file permissions
    - contextPath: SentinelOne.Threats.GetThreat.FilePath
      description: The file path
    - contextPath: SentinelOne.Threats.GetThreat.FileContentHash
      description: The file content hash.
    - contextPath: SentinelOne.Threats.GetThreat.FileSize
      description: The file size (Bytes)
    - contextPath: SentinelOne.Threats.GetThreat.IsSystemFile
      description: Is system file.
    - contextPath: SentinelOne.Threats.GetThreat.FileName
      description: File name.
    - contextPath: SentinelOne.Threats.GetThreat.CreatedAt
      description: Threat object creation time.
    - contextPath: SentinelOne.Threats.GetThreat.UpdatedAt
      description: Threat object updated time.
    description: Get threat
  - name: so-get-threats
    arguments:
    - name: content_hash
      description: Threat's content hash.
    - name: mitigation_status
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      - "4"
      - "5"
      description: Threat's mitigation status. Allowed values 0- Mitigated, 1- Active, 2-Blocked, 3- Suspicious, 4- Pending, 5- Suspicious canceled
    - name: created_at__lt
      description: System creation date (less than).
    - name: created_at__gt
      description: System creation date (greater than).
    - name: created_at__lte
      description: System creation date (less than or equal).
    - name: created_at__gte
      description: System creation date (greater than or equal).
    - name: updated_at__lt
      description: ystem update date (less than).
    - name: updated_at__gt
      description: System update date (greater than).
    - name: updated_at__lte
      description: ystem update date (less than or equal).
    - name: updated_at__gte
      description: System update date (greater than or equal).
    - name: resolved
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Resolved threat yes/no
    - name: hidden
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Hidden threat yes/no
    - name: display_name
      description: Threat display name.
    - name: skip
      description: Skip a number of items
    - name: limit
      description: Limit a number of items in the query. Default is 50
      defaultValue: "50"
    description: Get threats
  - name: so-threat-summary
    arguments: []
    description: Threats summary
  - name: so-mark-as-threat
    arguments:
    - name: threat_id
      required: true
      default: true
      description: ID of threat
    description: Mark as Threat
  - name: so-mitigate-threat
    arguments:
    - name: threat_id
      description: The threat id
      required: true
      default: true
    - name: action
      required: true
      auto: PREDEFINED
      predefined:
      - kill
      - quarantine
      - un-quarantine
      - remediate
      - rollback-remediation
      description: The action to take
    description: Mitigate threat
  - name: so-reslove-threats
    arguments:
    - name: threat_id
      required: true
      default: true
      description: The ID of the threat
    description: Resolve threats
tests:
- no test