Sentinel One - Query Endpoints

Runs Query on Endpoints for SHA1 values

SentinelOne · 7 tasks · 3 inputs · 0 outputs

Inputs

  • sha1 — Comma seperated strings of SHA1 hashes.
  • interval — Frequency that the polling command will run (minutes).
  • timeout — Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).

Commands used

sentinelone-create-query sentinelone-get-events

Flowchart

yes yes Create SentinelOne Query Create SentinelOne Query Check If Indicator Exist Check If Indicator Exist Create SentinelOne Query - sentinelone-create-query Create SentinelOne Query sentinelone-create-query Done Done Check If QueryID Exist Check If QueryID Exist Get Query Result - sentinelone-get-events Get Query Result sentinelone-get-events GenericPolling - GenericPolling GenericPolling GenericPolling