SentinelOne (v3.3.14)
Endpoint protection
- Author
- SentinelOne
- Support
- partner
- URL
- https://www.sentinelone.com/support/
- Default data source
- SentinelOneEventCollector
- Categories
- Endpoint
Incident fields (45)
- SentinelOne Account ID
- SentinelOne Account Name
- SentinelOne Agent Network Status
- SentinelOne Classification Source
- SentinelOne Cloud Provider
- SentinelOne Cloud Provider Account
- SentinelOne Cloud Provider Image
- SentinelOne Cloud Provider Instance ID
- SentinelOne Cloud Provider Instance Size
- SentinelOne Cloud Provider Location
- SentinelOne Cloud Provider Network
- SentinelOne Cloud Provider Resource Group
- SentinelOne Cloud Provider Role
- SentinelOne Cloud Provider Security Group
- SentinelOne Cloud Provider Service Account
- SentinelOne Cloud Provider SubnetId
- SentinelOne Cloud Provider Tags
- SentinelOne Group ID
- SentinelOne Group Name
- SentinelOne Kubernetes Cluster
- SentinelOne Kubernetes Controller Kind
- SentinelOne Kubernetes Controller Labels
- SentinelOne Kubernetes Controller Name
- SentinelOne Kubernetes Namespace
- SentinelOne Kubernetes Namespace Labels
- SentinelOne Kubernetes Node
- SentinelOne Kubernetes Node Labels
- SentinelOne Kubernetes Pod
- SentinelOne Kubernetes Pod Labels
- SentinelOne Kubernetes isContainerQuarantine
- SentinelOne Network Interface Details
- SentinelOne Site ID
- SentinelOne Site Name
- SentinelOne Threat Analyst Verdict
- SentinelOne Threat ID
- SentinelOne Threat Status
- SentinelOne Threat Story Line
- SentinelOne UAM Alert Analyst Verdict
- SentinelOne UAM Alert Analyst Verdict Mapped
- SentinelOne UAM Alert Attack Surfaces
- SentinelOne UAM Alert Detection Product
- SentinelOne UAM Alert External Id
- SentinelOne UAM Alert ID
- SentinelOne UAM Alert Name
- SentinelOne UAM Alert Status
Integrations (3)
- SentinelOne (Deprecated)
- SentinelOne v2
- SentinelOne Activity and Alerts
Layouts (1)
- SentinelOne Incident Layout
Modeling rules (1)
- SentinelOne Modeling Rule
Playbooks (2)
- Sentinel One - Endpoint data collection
- Sentinel One - Query Endpoints
Scripts (1)
- SentinelOneListAgents
README
This pack enables you to use SentinelOne for endpoint protection.
You can receive alerts from endpoints, search for processes on endpoints, block endpoints and manage the endpoint protection policy.
What does this pack do?
This pack enables you to
- Connect, disconnect, shutdown, and uninstall agents.
- Get information about agents and agent groups, move an agent from one group to another, delete groups, and send broadcast messages to groups of agents.
- Get information about threats, mark a suspicious behavior as a threat, and mitigate threats.
- Get information about the system sites and reactivate a site if necessary.
- Get information about activities, events and processes in the system.
The Sentinel One - Endpoint data collection playbook collects endpoint information by using SentinelOne commands.
The pack includes the SentinelOne v2 integration and the Sentinel One - Endpoint data collection playbook.
How does this pack work?
Create an instance of the SentinelOne v2 integration and start fetching information from the SentinelOne database.
Note: Support for this Pack moved to the partner on March, 23, 2023.
Please contact the partner directly via the support link on the right.