Sentinel One - Endpoint data collection Deprecated

Deprecated. No available replacement.

SentinelOne · 8 tasks · 1 input · 0 outputs

Details

IDSentinel One - Endpoint data collection
From Version5.0.0
Tasks8

README

Collects endpoint information based on SentinelOne commands.

Input:

  • Hostname (Default: ${Endpoint.Hostname})

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • SentinelOne

Scripts

  • Print
  • Exists

Commands

  • so-agents-query
  • so-get-agent-processes

Playbook Inputs

Name Description Default Value Required
Hostname The hostname of the device to run on. ${Endpoint.Hostname} Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Sentinel_One_Endpoint_data_collection

Inputs

  • Hostname — The Hostname of the device to run on

Commands used

so-agents-query so-get-agent-processes

Flowchart

no yes yes Start Start Get Host Agent info - so-agents-query Get Host Agent info so-agents-query Did we get the Agent info? - Exists Did we get the Agent info? Exists No Agent was found - Print No Agent was found Print Done Done Collect info Collect info Get Processes - so-get-agent-processes Get Processes so-get-agent-processes Is SentinelOne enabled? - Exists Is SentinelOne enabled? Exists

Source

playbook-Sentinel_One_-_Endpoint_data_collection.yml
Download History Raw 
id: Sentinel One - Endpoint data collection
version: -1
name: Sentinel One - Endpoint data collection
fromversion: "5.0.0"
deprecated: true
description: "Deprecated. No available replacement."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 27fc5e2d-5e47-4d5b-81ef-889cfeb1676e
    type: start
    task:
      id: 27fc5e2d-5e47-4d5b-81ef-889cfeb1676e
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": -120
        }
      }
    note: false
    timertriggers: []
  "1":
    id: "1"
    taskid: a127bd66-2910-4a57-86b2-e0c36065263c
    type: regular
    task:
      id: a127bd66-2910-4a57-86b2-e0c36065263c
      version: -1
      name: Get  Host Agent info
      script: SentinelOne|||so-agents-query
      type: regular
      iscommand: true
      brand: SentinelOne
      description: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      agent_version__in: {}
      computer_name__like:
        simple: ${inputs.Hostname}
      core_count__gte: {}
      core_count__lte: {}
      cpu_count__gte: {}
      cpu_count__lte: {}
      created_at__gt: {}
      created_at__lt: {}
      domain__in: {}
      encrypted_applications: {}
      group_id: {}
      group_id__in: {}
      id__in: {}
      id__nin: {}
      include_decommissioned: {}
      infected: {}
      is_active: {}
      is_decommissioned: {}
      is_pending_uninstall: {}
      is_uninstalled: {}
      is_up_to_date: {}
      last_active_date__gt: {}
      last_active_date__lt: {}
      limit: {}
      machine_type__in: {}
      network_status: {}
      os_type: {}
      os_type__in: {}
      policy_id__in: {}
      query: {}
      registerd_at__gt: {}
      registered_at__lt: {}
      skip: {}
      total_memory__gte: {}
      total_memory__lte: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: 8a5366c2-6ab4-4eeb-8515-edde825d2f0d
    type: condition
    task:
      id: 8a5366c2-6ab4-4eeb-8515-edde825d2f0d
      version: -1
      name: Did we get the Agent info?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "no":
      - "3"
      "yes":
      - "5"
    scriptarguments:
      value:
        simple: ${SentinelOne.Agents.Id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "3":
    id: "3"
    taskid: 88cf0630-08b2-4ec8-8dff-a49dc81a9f8c
    type: regular
    task:
      id: 88cf0630-08b2-4ec8-8dff-a49dc81a9f8c
      version: -1
      name: No Agent was found
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      value:
        simple: No Agent was found
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 51,
          "y": 545
        }
      }
    note: false
    timertriggers: []
  "4":
    id: "4"
    taskid: 85bc7a45-7439-417a-84a8-51eebf2753b3
    type: title
    task:
      id: 85bc7a45-7439-417a-84a8-51eebf2753b3
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 865
        }
      }
    note: false
    timertriggers: []
  "5":
    id: "5"
    taskid: 9300a326-4267-4ade-8870-24310ab4445c
    type: title
    task:
      id: 9300a326-4267-4ade-8870-24310ab4445c
      version: -1
      name: Collect info
      type: title
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: cdb41868-c1b9-471c-8abd-da5ca3cac6e6
    type: regular
    task:
      id: cdb41868-c1b9-471c-8abd-da5ca3cac6e6
      version: -1
      name: Get Processes
      description: Get agent proccesses
      script: SentinelOne|||so-get-agent-processes
      type: regular
      iscommand: true
      brand: SentinelOne
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      agent_id:
        simple: ${SentinelOne.Agents.Id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: d5db1794-ef8a-400b-8001-7f8f196f602e
    type: condition
    task:
      id: d5db1794-ef8a-400b-8001-7f8f196f602e
      version: -1
      name: Is SentinelOne enabled?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "1"
    scriptarguments:
      value:
        simple: ${modules(val.brand=="SentinelOne")}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 20
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1050,
        "width": 809,
        "x": 51,
        "y": -120
      }
    }
  }
inputs:
- key: Hostname
  value:
    simple: ${Endpoint.Hostname}
  required: false
  description: The Hostname of the device to run on
outputs: []
tests:
- No test