SentinelOne V2

Use the SentinelOne integration to send requests to your management server and get responses with data pulled from agents or from the management database.

Category

Endpoint

Pack

SentinelOne

Configuration parameters

• url — Server URL (e.g., https://usea1.sentinelone.net) (required)
• credentials —
• api_version — API Version (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• fetch_type — Fetch incidents from type
• fetch_uam_alert_type — Fetch incidents from UAM Alert type
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• fetch_threat_rank — Minimum risk score for importing incidents (0-10), where 0 is low risk and 10 is high risk. Relevant for API version 2.0.
• fetch_severity — Defines Alert severity to fetch.
• fetch_incidentStatus — Define which Alerts should be fetched.
• fetch_threat_incident_statuses — Define which Threats should be fetched.
• fetch_limit — Fetch limit: The maximum number of threats or alerts to fetch
• fetch_site_ids — Site IDs
• block_site_ids — Block Site IDs
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• token — API Token (Deprecated)
• incidentFetchInterval — Incidents Fetch Interval
• mirror_direction — Incident Mirroring Direction
• close_xsoar_incident — Close Mirrored XSOAR Incident

Commands (78)

• get-mapping-fields — Returns the list of fields for an incident type.
• get-modified-remote-data — Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
• get-remote-data — Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
• sentinelone-abort-endpoint-scan — Abort the endpoint virus scan on provided agent IDs.
• sentinelone-add-hash-to-blocklist — Add a hash to the blocklist in SentinelOne. Supports scoping by site, group, or account. If Scope not provided, the block will be global.
• sentinelone-agent-processes — Deprecated. Retrieves running processes for a specific agent.
• sentinelone-broadcast-message — Broadcasts a message to all agents that match the input filters.
• sentinelone-connect-agent — Connects agents to the network.
• sentinelone-create-bulk-ioc — Add bulk list of IoCs to the Threat Intelligence database. Relevant for API version 2.1.
• sentinelone-create-ioc — Add an IoC to the Threat Intelligence database. Relevant for API version 2.1.
• sentinelone-create-power-query — Deprecated. Use ***sentinelone-get-power-query-results*** instead. Start a Deep Visibility Power query to get back status and potential results (ping afterwards using the queryId if query has not finished). Relevant for API version 2.1.
• sentinelone-create-query — Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.
• sentinelone-create-star-rule — Creates a custom STAR rule. Relevant for API version 2.1.
• sentinelone-create-white-list-item — Creates an exclusion item that matches the specified input filter.
• sentinelone-delete-group — Deletes a group, by the group ID.
• sentinelone-delete-ioc — Delete an IOC from the Threat Intelligence database that matches a filter. Relevant for API version 2.1.
• sentinelone-delete-star-rule — Deletes Custom Detection Rules that match the specified input filter. Relevant for API version 2.1.
• sentinelone-disable-star-rules — Disable Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
• sentinelone-disconnect-agent — Disconnects agents from the network.
• sentinelone-download-fetched-file — Download a file fetched using th sentinelone-fetch-file command to submit the request and the sentinelone-get-activities command to get the download path.
• sentinelone-enable-star-rules — Activate Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
• sentinelone-endpoint-fetch-logs — Get the Agent and Endpoint logs from Agents for provided agent IDs.
• sentinelone-expire-site — Expire the site of the given ID.
• sentinelone-export-full-threat-timeline — Exports the threat's full timeline as a JSON File. Relevant for API version 2.1.
• sentinelone-export-threat-events — Exports the threat's events as a JSON File. Relevant for API version 2.1.
• sentinelone-fetch-file — Invokes a fetch files command against an agent endpoint.
• sentinelone-fetch-threat-file — Fetch a file associated with the threat that matches the filter.
• sentinelone-get-accounts — Returns details of accounts.
• sentinelone-get-activities — Returns a list of activities.
• sentinelone-get-agent — Returns the details of an agent according to the agent ID.
• sentinelone-get-agent-mac — Returns network interface details for a given Agent ID. This includes MAC address details and interface description.
• sentinelone-get-alerts — Get the list of alerts that matches the filter provided. Relevant for API version 2.1.
• sentinelone-get-blocklist — Retrieve the blocklist ("blacklist" in SentinelOne). You can filter by SHA1 or SHA256 hash. If the `global` flag is `true`, then group_ids, site_ids, and account_ids are ignored.
• sentinelone-get-dv-query-status — Returns status of a Deep Visibility Query.
• sentinelone-get-events — Returns all Deep Visibility events that match the query.
• sentinelone-get-groups — Returns data for the specified group.
• sentinelone-get-hash — Gets the file reputation by a SHA1 hash.
• sentinelone-get-installed-applications — Get the installed applications for a specific agent.
• sentinelone-get-iocs — Get the IOCs of a specified account that match the filter. Relevant for API version 2.1.
• sentinelone-get-power-query-results — Automate a power query and return the query results. (The maximum timeout of 300 seconds is allowed.)
• sentinelone-get-processes — Returns a list of Deep Visibility events from query by event type - process.
• sentinelone-get-remote-script-task-results — Get a script's result download URL.
• sentinelone-get-remote-script-task-status — Get remote scripts tasks using a variety of filters.
• sentinelone-get-service-users — Returns all service users that match the specified filter values.
• sentinelone-get-site — Returns information about the site, according to the site ID.
• sentinelone-get-sites — Returns all sites that match the specified criteria.
• sentinelone-get-star-rules — Get a list of custom detection rules for a given scope. Relevant for API version 2.1.
• sentinelone-get-threat-notes — Returns threat notes.
• sentinelone-get-threats — Returns threats according to the specified filters.
• sentinelone-get-white-list — Lists all exclusion items that match the specified input filter.
• sentinelone-initiate-endpoint-scan — Initiate the endpoint virus scan on provided agent IDs.
• sentinelone-list-agents — Returns all agents that match the specified criteria.
• sentinelone-list-installed-singularity-marketplace-applications — Returns all installed singularity marketplace applications that match the specified filter values.
• sentinelone-mark-as-threat — Marks suspicious threats as threats. Can only be used with API V2.0.
• sentinelone-mitigate-threat — Applies a mitigation action to a group of threats that match the specified input filter.
• sentinelone-move-agent — Moves agents to a new group.
• sentinelone-ping-power-query — Deprecated. Use ***sentinelone-get-power-query-results*** instead. Ping a Deep Visibility Power query using the queryId argument if results have not returned from an initial Power query or a previous ping. Relevant for API version 2.1.
• sentinelone-reactivate-site — Reactivates an expired site.
• sentinelone-remote-script-automate-results — Automate a remote script's execution cycle and return the script's results.
• sentinelone-remove-hash-from-blocklist — Remove a hash from the global blocklist in SentinelOne.
• sentinelone-remove-item-from-whitelist — Remove an item from the SentinelOne exclusion list.
• sentinelone-resolve-threat — Resolves threats using the threat ID. Can only be used with API V2.0.
• sentinelone-run-powerquery — Run a PowerQuery, where you can pipe one or many search expressions into a set of commands to transform, manipulate, group, and summarize your data.
• sentinelone-run-remote-script — Run a remote script that was uploaded to the SentinelOne Script Library.
• sentinelone-shutdown-agent — Sends a shutdown command to all agents that match the input filter.
• sentinelone-threat-analysis — Returns threat analysis. Can only be used with API V2.1.
• sentinelone-threat-download-from-cloud — Download a file associated with the threat from the Cloud (BinaryVault).
• sentinelone-threat-summary — Returns a dashboard threat summary. Can only be used with API V2.1.
• sentinelone-uninstall-agent — Sends an uninstall command to all agents that match the input filter.
• sentinelone-update-alerts-status — Updates the incident status to a group of alerts that match the specified input filter. Relevant for API version 2.1.
• sentinelone-update-alerts-verdict — Updates the analyst verdict to a group of alerts that match the specified input filter. Relevant for API version 2.1.
• sentinelone-update-star-rule — Updates a custom STAR rule. Relevant for API version 2.1.
• sentinelone-update-threats-status — Updates the incident status to a group of threats that match the specified input filter. Relevant for API version 2.1.
• sentinelone-update-threats-verdict — Updates the analyst verdict to a group of threats that match the specified input filter. Relevant for API version 2.1.
• sentinelone-update-uam-alert-status — Updates the status for a group of UAM alerts. Relevant for API version 2.1.
• sentinelone-update-uam-alert-verdict — Updates the analyst verdict for a group of UAM alerts. Relevant for API version 2.1.
• sentinelone-write-threat-note — Add a threat note to one or more threats. Relevant for API version 2.1.
• update-remote-system — Pushes local changes to the remote system.