category: Endpoint
provider: SentinelOne
sectionorder:
- Connect
- Collect
commonfields:
  id: SentinelOne V2
  version: -1
configuration:
- name: url
  display: Server URL (e.g., https://usea1.sentinelone.net)
  required: true
  type: 0
  section: Connect
- name: credentials
  display: ""
  type: 9
  section: Connect
  displaypassword: API Token
  hiddenusername: true
  required: false
- name: api_version
  display: API Version
  required: true
  defaultvalue: "2.1"
  type: 15
  section: Connect
  options:
  - "2.0"
  - "2.1"
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- name: fetch_type
  display: Fetch incidents from type
  defaultvalue: Threats
  type: 15
  section: Collect
  options:
  - Alerts
  - Threats
  - Both
  required: false
- name: fetch_uam_alert_type
  display: Fetch incidents from UAM Alert type
  type: 15
  section: Collect
  options:
  - ALL
  - CLOUD
  - CUSTOM_ALERTS
  - ENDPOINT
  - IDENTITY
  - STAR
  - THIRD_PARTY
  required: false
- name: fetch_time
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  defaultvalue: "3 days"
  type: 0
  section: Collect
  required: false
- name: fetch_threat_rank
  display: "Minimum risk score for importing incidents (0-10), where 0 is low risk and 10 is high risk. Relevant for API version 2.0."
  defaultvalue: '5'
  type: 0
  section: Collect
  required: false
- name: fetch_severity
  display: Defines Alert severity to fetch.
  type: 16
  section: Collect
  options:
  - High
  - Medium
  - Low
  - Critical
  required: false
- name: fetch_incidentStatus
  display: Define which Alerts should be fetched.
  type: 16
  section: Collect
  defaultvalue: UNRESOLVED
  options:
  - RESOLVED
  - UNRESOLVED
  - IN_PROGRESS
  required: false
- name: fetch_threat_incident_statuses
  display: 'Define which Threats should be fetched.'
  type: 16
  section: Collect
  defaultvalue: UNRESOLVED
  required: false
  options:
  - RESOLVED
  - UNRESOLVED
  - IN_PROGRESS
- name: fetch_limit
  display: 'Fetch limit: The maximum number of threats or alerts to fetch'
  type: 0
  section: Collect
  required: false
  defaultvalue: '10'
- name: fetch_site_ids
  display: Site IDs
  type: 0
  section: Collect
  additionalinfo: Comma-separated list of site IDs to fetch incidents for. Leave blank to fetch all sites.
  required: false
- name: block_site_ids
  display: Block Site IDs
  type: 0
  section: Collect
  required: false
  additionalinfo: Comma-separated list of site IDs for where hashes should be blocked. If left blank all hashes will be blocked globally. If filled out with site ids all hashes will be no longer be blocked globally, they will now be blocked in the scope of those sites.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: API Token (Deprecated)
  name: token
  type: 4
  hidden: true
  section: Connect
  required: false
  additionalinfo: Use the "API Token (Recommended)" parameter instead.
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
- additionalinfo: 'Choose the direction to mirror the incident: Incoming (from SentinelOne to Cortex XSOAR), Outgoing (from Cortex XSOAR to SentinelOne), or Incoming and Outgoing (from/to Cortex XSOAR and SentinelOne). Cortex XSOAR only parameter.'
  defaultvalue: None
  display: Incident Mirroring Direction
  name: mirror_direction
  type: 15
  section: Collect
  required: false
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  hidden:
  - marketplacev2
  - platform
- additionalinfo: When selected, closing the SentinelOne ticket is mirrored in Cortex XSOAR.
  defaultvalue: 'false'
  display: Close Mirrored XSOAR Incident
  name: close_xsoar_incident
  type: 8
  section: Collect
  required: false
description: Use the SentinelOne integration to send requests to your management server and get responses with data pulled from agents or from the management database.
display: SentinelOne v2
name: SentinelOne V2
script:
  commands:
  - arguments:
    - description: The computer name by which to filter the results. It can match a partial computer name value (substring).
      name: computer_name
    - auto: PREDEFINED
      description: 'A comma-separated list of scan statuses by which to filter the results, for example: "started,aborted".'
      name: scan_status
      predefined:
      - started
      - none
      - finished
      - aborted
    - auto: PREDEFINED
      description: 'Included operating system types, for example: "windows".'
      isArray: true
      name: os_type
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
    - description: 'Endpoint creation timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_at
    - description: Minimum number of threats per agent.
      name: min_active_threats
    - defaultValue: "10"
      description: The maximum number of agents to return.
      name: limit
    - description: Query params field=value pairs delimited by comma (e.g., activeThreats=3,gatewayIp=1.2.3.4). Query params are OR'd.
      name: params
    - description: A comma-separated list of additionals fields to display.
      name: columns
      isArray: true
    description: Returns all agents that match the specified criteria.
    name: sentinelone-list-agents
    outputs:
    - contextPath: SentinelOne.Agents.NetworkStatus
      description: The agent network status.
      type: string
    - contextPath: SentinelOne.Agents.ID
      description: The agent ID.
      type: string
    - contextPath: SentinelOne.Agents.AgentVersion
      description: The agent software version.
      type: string
    - contextPath: SentinelOne.Agents.IsDecommissioned
      description: Whether the agent is decommissioned.
      type: boolean
    - contextPath: SentinelOne.Agents.IsActive
      description: Whether the agent is active.
      type: boolean
    - contextPath: SentinelOne.Agents.LastActiveDate
      description: When was the agent last active.
      type: date
    - contextPath: SentinelOne.Agents.RegisteredAt
      description: The registration date of the agent.
      type: date
    - contextPath: SentinelOne.Agents.ExternalIP
      description: The agent IP address.
      type: string
    - contextPath: SentinelOne.Agents.ThreatCount
      description: Number of active threats.
      type: number
    - contextPath: SentinelOne.Agents.EncryptedApplications
      description: Whether disk encryption is enabled.
      type: boolean
    - contextPath: SentinelOne.Agents.OSName
      description: Name of operating system.
      type: string
    - contextPath: SentinelOne.Agents.ComputerName
      description: Name of agent computer.
      type: string
    - contextPath: SentinelOne.Agents.MachineType
      description: Machine type.
      type: string
    - contextPath: SentinelOne.Agents.Domain
      description: Domain name of the agent.
      type: string
    - contextPath: SentinelOne.Agents.CreatedAt
      description: Creation time of the agent.
      type: date
    - contextPath: SentinelOne.Agents.SiteName
      description: Site name associated with the agent.
      type: string
    - contextPath: SentinelOne.Agents.Tags
      description: Tags associated with the agent.
      type: unknown
  - arguments:
    - auto: PREDEFINED
      description: Exclusion item type.
      name: exclusion_type
      predefined:
      - file_type
      - path
      - white_hash
      - certificate
      - browser
      required: true
    - description: Value of the exclusion item for the exclusion list.
      name: exclusion_value
      required: true
    - auto: PREDEFINED
      description: Operating system type. Required for hash exclusions.
      name: os_type
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
      required: true
    - description: Description for adding the exclusion item.
      name: description
    - auto: PREDEFINED
      description: Exclusion mode (path exclusion only).
      name: exclusion_mode
      predefined:
      - suppress
      - disable_in_process_monitor_deep
      - disable_in_process_monitor
      - disable_all_monitors
      - disable_all_monitors_deep
    - description: Excluded path for a path exclusion list.
      name: path_exclusion_type
    - description: A comma-separated list of group IDs by which to filter.
      isArray: true
      name: group_ids
    - description: A comma-separated list of site IDs by which to filter.
      isArray: true
      name: site_ids
    description: Creates an exclusion item that matches the specified input filter.
    name: sentinelone-create-white-list-item
    outputs:
    - contextPath: SentinelOne.Exclusions.ID
      description: The entity ID on the allow list.
      type: string
    - contextPath: SentinelOne.Exclusions.Type
      description: The item type on the allow list.
      type: string
    - contextPath: SentinelOne.Exclusions.CreatedAt
      description: Time when the allow list item was created.
      type: date
  - arguments:
    - description: 'List of IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: item_ids
    - auto: PREDEFINED
      description: 'A comma-separated list of operating system types by which to filter, for example: "windows, linux".'
      isArray: true
      name: os_types
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
    - auto: PREDEFINED
      description: Exclusion type.
      name: exclusion_type
      predefined:
      - file_type
      - path
      - white_hash
      - certificate
      - browser
    - defaultValue: "10"
      description: The maximum number of items to return.
      name: limit
    - defaultValue: "false"
      description: Whether to include parent information of each item. Default value is false.
      name: include_parent
    - defaultValue: "false"
      description: Whether to include children information of each item. Default value is false.
      name: include_children
    description: Lists all exclusion items that match the specified input filter.
    name: sentinelone-get-white-list
    outputs:
    - contextPath: SentinelOne.Exclusions.ID
      description: The exclusion item ID.
      type: string
    - contextPath: SentinelOne.Exclusions.Type
      description: The exclusion item type.
      type: string
    - contextPath: SentinelOne.Exclusions.CreatedAt
      description: Timestamp when the exclusion item was added.
      type: date
    - contextPath: SentinelOne.Exclusions.Value
      description: Value of the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.Source
      description: Source of the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.UserID
      description: User ID of the user qho added the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.UpdatedAt
      description: Timestamp when the exclusion item was updated.
      type: date
    - contextPath: SentinelOne.Exclusions.OsType
      description: Operating system type of the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.UserName
      description: User name of the user who added the exclusion item.
      type: string
    - contextPath: SentinelOne.Exclusions.Mode
      description: 'A comma-separated list of modes by which to filter (path exclusions only), for example: "suppress".'
      type: string
  - arguments:
    - description: The content hash.
      name: hash
      required: true
    description: Gets the file reputation by a SHA1 hash.
    name: sentinelone-get-hash
    outputs:
    - contextPath: SentinelOne.Hash.Rank
      description: The hash reputation (1-10).
      type: Number
    - contextPath: SentinelOne.Hash.Verdict
      description: The verdict of a hash.
      type: String
    - contextPath: SentinelOne.Hash.Hash
      description: The content hash.
      type: String
  - arguments:
    - description: A comma-separated list of content hashes of the threat.
      isArray: true
      name: content_hash
    - auto: PREDEFINED
      description: A comma-separated list of mitigation statuses.
      isArray: true
      name: mitigation_status
      predefined:
      - mitigated
      - active
      - blocked
      - suspicious
      - pending
      - suspicious_resolved
    - description: 'Searches for threats created before this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_before
    - description: 'Searches for threats created after this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_after
    - description: 'Searches for threats created on or before this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_until
    - description: 'Search for threats created on or after this timestamp, for example: "2018-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".'
      name: created_from
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to only return resolved threats.
      name: resolved
      predefined:
      - "false"
      - "true"
    - description: Threat display name. For API version 2.0 it can be a partial display name, doesn't have to be an exact match.
      name: display_name
    - defaultValue: "20"
      description: The maximum number of threats to return.
      name: limit
    - description: Full free-text search for fields. Can be "content_hash", "file_display_name", "file_path", "computer_name", or "uuid".
      name: query
    - description: 'A comma-separated list of threat IDs, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: threat_ids
    - auto: PREDEFINED
      description: 'A comma-separated list of threat classifications to search, for example: "Malware", "Network", "Benign".'
      name: classifications
      predefined:
      - Engine
      - Static
      - Cloud
      - Behavioral
    - description: Risk level threshold to retrieve (1-10). Relevant for API version 2.0 only.
      name: rank
    - description: 'A comma-separated list of site IDs to search for threats, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: site_ids
    - description: 'Incident status. Example: "IN_PROGRESS, UNRESOLVED".'
      name: incident_statuses
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to include the resolved parameter in the query.
      name: include_resolved_param
      predefined:
      - "false"
      - "true"
    description: Returns threats according to the specified filters.
    name: sentinelone-get-threats
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.AgentComputerName
      description: The agent computer name.
      type: String
    - contextPath: SentinelOne.Threat.CreatedDate
      description: The threat creation date.
      type: Date
    - contextPath: SentinelOne.Threat.SiteID
      description: The site ID.
      type: String
    - contextPath: SentinelOne.Threat.Classification
      description: The threat classification.
      type: string
    - contextPath: SentinelOne.Threat.ClassificationSource
      description: Source of the threat classification.
      type: string
    - contextPath: SentinelOne.Threat.ConfidenceLevel
      description: SentinelOne threat confidence level.
      type: string
    - contextPath: SentinelOne.Threat.FileSha256
      description: SHA256 hash of the file content.
      type: string
    - contextPath: SentinelOne.Threat.MitigationStatus
      description: The agent mitigation status.
      type: String
    - contextPath: SentinelOne.Threat.AgentID
      description: The threat agent ID.
      type: String
    - contextPath: SentinelOne.Threat.Rank
      description: The number representing the cloud reputation (1-10).
      type: Number
    - contextPath: SentinelOne.Threat.MarkedAsBenign
      description: Whether the threat is marked as benign. Relevant for version 2.0 only.
      type: Boolean
  - arguments:
    - description: 'A comma-separated list of group IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: group_ids
    description: Returns a dashboard threat summary. Can only be used with API V2.1.
    name: sentinelone-threat-summary
    outputs:
    - contextPath: SentinelOne.Threat.NotResolved
      description: Number of unresolved threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.SuspiciousNotMitigatedNotResolved
      description: Number of unmitigated suspicious threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.SuspiciousNotResolved
      description: Number of unresolved suspicious threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.Resolved
      description: Number of resolved threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.InProgress
      description: Number of active threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.Total
      description: Total number of threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.NotMitigated
      description: Number of unmitigated threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.MaliciousNotResolved
      description: Number of unresolved malicious threats in the system.
      type: Number
    - contextPath: SentinelOne.Threat.NotMitigatedNotResolved
      description: Number of unmitigated and unresolved threats in the system.
      type: Number
  - arguments:
    - description: 'Threat ID to get the analysis, for example: "2341398296147451190".'
      name: threat_id
      required: true
    description: Returns threat analysis. Can only be used with API V2.1.
    name: sentinelone-threat-analysis
    outputs:
    - contextPath: SentinelOne.Threat.AgentDetectionInfo
      description: Agent detection time information.
      type: 18
    - contextPath: SentinelOne.Threat.AgentRealtimeInfo
      description: Agent realtime information.
      type: 18
    - contextPath: SentinelOne.Threat.ThreatInfo
      description: Threat information.
      type: 18
  - arguments:
    - description: A comma-separated list of threat IDs.
      isArray: true
      name: threat_ids
    - auto: PREDEFINED
      description: Scope to use for exclusions.
      name: target_scope
      predefined:
      - site
      - tenant
      required: true
    description: Marks suspicious threats as threats. Can only be used with API V2.0.
    name: sentinelone-mark-as-threat
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.MarkedAsThreat
      description: Whether the suspicious threat was successfully marked as a threat.
      type: Boolean
  - arguments:
    - auto: PREDEFINED
      description: Mitigation action.
      name: action
      predefined:
      - kill
      - quarantine
      - un-quarantine
      - remediate
      - rollback-remediation
      required: true
    - description: A comma-separated list of threat IDs.
      isArray: true
      name: threat_ids
      required: true
    description: Applies a mitigation action to a group of threats that match the specified input filter.
    name: sentinelone-mitigate-threat
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Mitigated
      description: Whether the threat was successfully mitigated.
      type: Boolean
    - contextPath: SentinelOne.Threat.Mitigation.Action
      description: The mitigation action performed.
      type: String
  - arguments:
    - description: A comma-separated list of threat IDs.
      isArray: true
      name: threat_ids
      required: true
    description: Resolves threats using the threat ID. Can only be used with API V2.0.
    name: sentinelone-resolve-threat
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Resolved
      description: Whether the threat was successfully resolved.
      type: Boolean
  - arguments:
    - description: A comma-separated list of agent IDs.
      isArray: true
      name: agent_id
      required: true
    description: Returns the details of an agent according to the agent ID.
    name: sentinelone-get-agent
    outputs:
    - contextPath: SentinelOne.Agent.NetworkStatus
      description: The agent network status.
      type: string
    - contextPath: SentinelOne.Agent.ID
      description: The agent ID.
      type: string
    - contextPath: SentinelOne.Agent.AgentVersion
      description: The agent software version.
      type: string
    - contextPath: SentinelOne.Agent.IsDecommissioned
      description: Whether the agent is decommissioned.
      type: boolean
    - contextPath: SentinelOne.Agent.IsActive
      description: Whether the agent is active.
      type: boolean
    - contextPath: SentinelOne.Agent.LastActiveDate
      description: When was the agent last active.
      type: date
    - contextPath: SentinelOne.Agent.RegisteredAt
      description: The registration date of the agent.
      type: date
    - contextPath: SentinelOne.Agent.ExternalIP
      description: The agent IP address.
      type: string
    - contextPath: SentinelOne.Agent.ThreatCount
      description: Number of active threats.
      type: number
    - contextPath: SentinelOne.Agent.EncryptedApplications
      description: Whether disk encryption is enabled.
      type: boolean
    - contextPath: SentinelOne.Agent.OSName
      description: Name of the operating system.
      type: string
    - contextPath: SentinelOne.Agent.ComputerName
      description: Name of the agent computer.
      type: string
    - contextPath: SentinelOne.Agent.MachineType
      description: Machine type.
      type: string
    - contextPath: SentinelOne.Agent.Domain
      description: Domain name of the agent.
      type: string
    - contextPath: SentinelOne.Agent.CreatedAt
      description: Agent creation time.
      type: date
    - contextPath: SentinelOne.Agent.SiteName
      description: Site name associated with the agent.
      type: string
  - arguments:
    - description: 'Timestamp of the last update, for example: "2018-02-27T04:49:26.257525Z".'
      name: updated_at
    - description: "Full-text search for fields: name, account_name."
      name: query
    - auto: PREDEFINED
      description: Site type.
      name: site_type
      predefined:
      - Trial
      - Paid
      - POC
      - DEV
      - NFR
    - auto: PREDEFINED
      description: Returns sites that support the specified features.
      name: features
      predefined:
      - firewall-control
      - device-control
      - ioc
    - auto: PREDEFINED
      description: Site state.
      name: state
      predefined:
      - active
      - deleted
      - expired
    - auto: PREDEFINED
      description: The suite of product features active for this site.
      name: suite
      predefined:
      - Core
      - Complete
    - auto: PREDEFINED
      description: Sites for which the user has admin privileges.
      name: admin_only
      predefined:
      - "true"
      - "false"
    - description: 'Account ID, for example: "225494730938493804".'
      name: account_id
    - description: 'Site name, for example: "My Site".'
      name: site_name
    - description: 'Timestamp of the site creation, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_at
    - defaultValue: "50"
      description: Maximum number of results to return.
      name: limit
    description: Returns all sites that match the specified criteria.
    name: sentinelone-get-sites
    outputs:
    - contextPath: SentinelOne.Site.Creator
      description: The site creator name.
      type: string
    - contextPath: SentinelOne.Site.Name
      description: The site name.
      type: string
    - contextPath: SentinelOne.Site.Type
      description: The site type.
      type: string
    - contextPath: SentinelOne.Site.AccountName
      description: The site account name.
      type: string
    - contextPath: SentinelOne.Site.State
      description: The site state.
      type: string
    - contextPath: SentinelOne.Site.HealthStatus
      description: The health status of the site.
      type: boolean
    - contextPath: SentinelOne.Site.Suite
      description: The suite to which the site belongs.
      type: string
    - contextPath: SentinelOne.Site.ActiveLicenses
      description: Number of active licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.ID
      description: ID of the site.
      type: string
    - contextPath: SentinelOne.Site.TotalLicenses
      description: Number of total licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.CreatedAt
      description: Timestamp when the site was created.
      type: date
    - contextPath: SentinelOne.Site.Expiration
      description: Timestamp when the site will expire.
      type: string
    - contextPath: SentinelOne.Site.UnlimitedLicenses
      description: Whether the site has unlimited licenses.
      type: boolean
  - arguments:
    - description: ID of the site.
      name: site_id
      required: true
    description: Returns information about the site, according to the site ID.
    name: sentinelone-get-site
    outputs:
    - contextPath: SentinelOne.Site.Creator
      description: The site creator name.
      type: string
    - contextPath: SentinelOne.Site.Name
      description: The site name.
      type: string
    - contextPath: SentinelOne.Site.Type
      description: The site type.
      type: string
    - contextPath: SentinelOne.Site.AccountName
      description: The site account name.
      type: string
    - contextPath: SentinelOne.Site.State
      description: The site state.
      type: string
    - contextPath: SentinelOne.Site.HealthStatus
      description: The health status of the site.
      type: boolean
    - contextPath: SentinelOne.Site.Suite
      description: The suite to which the site belongs.
      type: string
    - contextPath: SentinelOne.Site.ActiveLicenses
      description: Number of active licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.ID
      description: ID of the site.
      type: string
    - contextPath: SentinelOne.Site.TotalLicenses
      description: Number of total licenses for the site.
      type: number
    - contextPath: SentinelOne.Site.CreatedAt
      description: Timestamp when the site was created.
      type: date
    - contextPath: SentinelOne.Site.Expiration
      description: Timestamp when the site will expire.
      type: string
    - contextPath: SentinelOne.Site.UnlimitedLicenses
      description: Whether the site has unlimited licenses.
      type: boolean
    - contextPath: SentinelOne.Site.AccountID
      description: Site account ID.
      type: string
    - contextPath: SentinelOne.Site.IsDefault
      description: Whether the site is the default site.
      type: boolean
  - arguments:
    - description: 'Site ID. For example: "225494730938493804".'
      name: site_id
      required: true
    - description: If false, an expiration should be supplied.
      name: unlimited
    - description: Expiration date in case unlimited is false, for example, "2019-08-03T04:49:26.257525Z".
      name: expiration
    description: Reactivates an expired site.
    name: sentinelone-reactivate-site
    outputs:
    - contextPath: SentinelOne.Site.ID
      description: Site ID.
      type: string
    - contextPath: SentinelOne.Site.Reactivated
      description: Whether the site was reactivated.
      type: boolean
  - arguments:
    - description: 'Return activities created after this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_after
    - description: Email address of the user who invoked the activity (if applicable).
      name: user_emails
    - description: 'List of group IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: group_ids
    - description: 'Return activities created on or before this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_until
    - auto: PREDEFINED
      description: Include internal activities hidden from display.
      name: include_hidden
      predefined:
      - "true"
      - "false"
    - description: 'A comma-separated list of activity IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: activities_ids
    - description: 'Return activities created before this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_before
    - description: 'A comma-separated list of threat IDs for which to return activities, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: threats_ids
    - description: 'A comma-separated list of activity codes to return, for example: "52,53,71,72".'
      isArray: true
      name: activity_types
    - description: 'A comma-separated list of user IDs for users that invoked the activity (if applicable), for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: user_ids
    - description: 'Return activities created on or after this timestamp, for example: "2018-02-27T04:49:26.257525Z".'
      name: created_from
    - description: 'Return activities created within this range (inclusive), for example: "1514978764288-1514978999999".'
      name: created_between
    - description: 'Return activities related to specified agents. For example: "225494730938493804,225494730938493915".'
      isArray: true
      name: agent_ids
    - description: Maximum number of items to return (1-100).
      name: limit
    - name: sort_by
      auto: PREDEFINED
      predefined:
      - activityType
      - createdAt
      - id
      description: Field to sort results by.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Order to sort by.
    description: Returns a list of activities.
    name: sentinelone-get-activities
    outputs:
    - contextPath: SentinelOne.Activity.AgentID
      description: Related agent (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.AgentUpdatedVersion
      description: Agent's new version (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.SiteID
      description: Related site (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.UserID
      description: The user who invoked the activity (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.SecondaryDescription
      description: Secondary description.
      type: String
    - contextPath: SentinelOne.Activity.OsFamily
      description: Agent's operating system type (if applicable). Can be "linux", "macos", "windows", or "windows_legacy".
      type: String
    - contextPath: SentinelOne.Activity.ActivityType
      description: Activity type.
      type: Number
    - contextPath: SentinelOne.Activity.data.SiteID
      description: The site ID.
      type: String
    - contextPath: SentinelOne.Activity.data.SiteName
      description: The site name.
      type: String
    - contextPath: SentinelOne.Activity.data.username
      description: The name of the site creator.
      type: String
    - contextPath: SentinelOne.Activity.Hash
      description: Threat file hash (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.UpdatedAt
      description: Activity last updated time (UTC).
      type: Date
    - contextPath: SentinelOne.Activity.Comments
      description: Comments for the activity.
      type: String
    - contextPath: SentinelOne.Activity.ThreatID
      description: Related threat (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.PrimaryDescription
      description: Primary description for the activity.
      type: String
    - contextPath: SentinelOne.Activity.GroupID
      description: Related group (if applicable).
      type: String
    - contextPath: SentinelOne.Activity.ID
      description: Activity ID.
      type: String
    - contextPath: SentinelOne.Activity.CreatedAt
      description: Activity creation time (UTC).
      type: Date
    - contextPath: SentinelOne.Activity.Description
      description: Extra activity information.
      type: String
  - arguments:
    - description: 'Group type, for example: "static".'
      name: group_type
    - description: 'A comma-separated list of group IDs by which to filter, for example: "225494730938493804,225494730938493915".'
      isArray: true
      name: group_ids
    - description: 'Group ID by which to filter, for example: "225494730938493804".'
      name: group_id
    - auto: PREDEFINED
      description: Whether this is the default group.
      name: is_default
      predefined:
      - "true"
      - "false"
    - description: The name of the group.
      name: name
    - description: Free-text search.
      name: query
    - description: The priority of a dynamic group over others, for example, "1", which is the highest priority.
      name: rank
    - description: Maximum number of items to return (1-200).
      name: limit
    description: Returns data for the specified group.
    name: sentinelone-get-groups
    outputs:
    - contextPath: SentinelOne.Group.siteId
      description: The ID of the site of which this group is a member.
      type: String
    - contextPath: SentinelOne.Group.filterName
      description: If the group is dynamic, the name of the filter which is used to associate agents.
      type: String
    - contextPath: SentinelOne.Group.creatorId
      description: The ID of the user who created the group.
      type: String
    - contextPath: SentinelOne.Group.name
      description: The name of the group.
      type: String
    - contextPath: SentinelOne.Group.creator
      description: The user who created the group.
      type: String
    - contextPath: SentinelOne.Group.rank
      description: The rank, which sets the priority of a dynamic group over others.
      type: Number
    - contextPath: SentinelOne.Group.updatedAt
      description: Timestamp of the last update.
      type: Date
    - contextPath: SentinelOne.Group.totalAgents
      description: Number of agents in the group.
      type: Number
    - contextPath: SentinelOne.Group.filterId
      description: If the group is dynamic, the group ID of the filter that is used to associate agents.
      type: String
    - contextPath: SentinelOne.Group.isDefault
      description: Whether the groups is the default group of the site.
      type: Boolean
    - contextPath: SentinelOne.Group.inherits
      description: Whether the policy is inherited from a site. "False" if the group has its own edited policy.
      type: Boolean
    - contextPath: SentinelOne.Group.type
      description: Group type. Can be static or dynamic.
      type: String
    - contextPath: SentinelOne.Group.id
      description: The ID of the group.
      type: String
    - contextPath: SentinelOne.Group.createdAt
      description: Timestamp of group creation.
      type: Date
  - arguments:
    - description: The ID of the group to move the agent to.
      name: group_id
      required: true
    - description: Agents IDs.
      isArray: true
      name: agents_ids
    description: Moves agents to a new group.
    name: sentinelone-move-agent
    outputs:
    - contextPath: SentinelOne.Agent.AgentsMoved
      description: The number of agents that were moved to another group.
      type: Number
  - arguments:
    - description: The ID of the group to delete.
      name: group_id
      required: true
    description: Deletes a group, by the group ID.
    name: sentinelone-delete-group
    outputs:
    - contextPath: SentinelOne.DeleteGroup.Success
      description: The status of the command.
      type: String
  - arguments:
    - description: The ID of the agent from which to retrieve the processes.
      name: agents_ids
      required: true
    deprecated: true
    description: Deprecated. Retrieves running processes for a specific agent.
    name: sentinelone-agent-processes
    outputs:
    - contextPath: SentinelOne.Agent.memoryUsage
      description: Memory usage (MB).
      type: Number
    - contextPath: SentinelOne.Agent.startTime
      description: The process start time.
      type: Date
    - contextPath: SentinelOne.Agent.pid
      description: The process ID.
      type: Number
    - contextPath: SentinelOne.Agent.processName
      description: The name of the process.
      type: String
    - contextPath: SentinelOne.Agent.cpuUsage
      description: CPU usage (%).
      type: Number
    - contextPath: SentinelOne.Agent.executablePath
      description: Executable path.
      type: String
  - arguments:
    - description: A comma-separated list of agent IDs to connect to the network. Run the list-agents command to get a list of agent IDs.
      isArray: true
      name: agent_id
      required: true
    description: Connects agents to the network.
    name: sentinelone-connect-agent
    outputs:
    - contextPath: SentinelOne.Agent.AgentsAffected
      description: The number of affected agents.
      type: Number
    - contextPath: SentinelOne.Agent.NetworkStatus
      description: Agent network status.
      type: String
    - contextPath: SentinelOne.Agent.ID
      description: Input agents' IDs.
      type: String
  - arguments:
    - description: A comma-separated list of agent IDs to disconnect from the network. Run the list-agents command to get a list of agent IDs.
      isArray: true
      name: agent_id
      required: true
    description: Disconnects agents from the network.
    name: sentinelone-disconnect-agent
    outputs:
    - contextPath: SentinelOne.Agent.NetworkStatus
      description: Agent network status.
      type: String
    - contextPath: SentinelOne.Agent.ID
      description: Input agents' IDs.
      type: String
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: The message to broadcast to agents.
      name: message
      required: true
    - auto: PREDEFINED
      description: Whether to only include active agents. Default is "false".
      name: active_agent
      predefined:
      - "true"
      - "false"
    - description: A comma-separated list of group IDs by which to filter the results.
      isArray: true
      name: group_id
    - description: A comma-separated list of agent IDs by which to filter the results.
      isArray: true
      name: agent_id
    - description: A comma-separated of included network domains.
      isArray: true
      name: domain
    description: Broadcasts a message to all agents that match the input filters.
    name: sentinelone-broadcast-message
    outputs:
    - contextPath: SentinelOne.BroadcastMessage.Affected
      description: Number of affected endpoints.
      type: String
  - arguments:
    - defaultValue: "50"
      description: Maximum number of items to return (1-100).
      name: limit
    - description: 'QueryId obtained when creating a query in the sentinelone-create-query command. Example: "q1xx2xx3".'
      name: query_id
      required: true
    - description: Cursor pointer to get next page of results from query.
      name: cursor
    - description: A comma-separated list of additionals fields to display.
      name: columns
      isArray: true
    description: Returns all Deep Visibility events that match the query.
    name: sentinelone-get-events
    outputs:
    - contextPath: SentinelOne.Event.ProcessUID
      description: Process unique identifier.
      type: String
    - contextPath: SentinelOne.Event.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: SentinelOne.Event.AgentOS
      description: Operating system type. Can be "windows", "linux", "macos", or "windows_legac".
      type: String
    - contextPath: SentinelOne.Event.ProcessID
      description: The process ID.
      type: Number
    - contextPath: SentinelOne.Event.User
      description: User assigned to the event.
      type: String
    - contextPath: SentinelOne.Event.Time
      description: Process start time.
      type: Date
    - contextPath: SentinelOne.Event.Endpoint
      description: The agent name.
      type: String
    - contextPath: SentinelOne.Event.SiteName
      description: Site name.
      type: String
    - contextPath: SentinelOne.Event.EventType
      description: Event type. Can be "events", "file", "ip", "url", "dns", "process", "registry", "scheduled_task", or "logins".
      type: String
    - contextPath: SentinelOne.Event.ProcessName
      description: The name of the process.
      type: String
    - contextPath: SentinelOne.Event.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: SentinelOne.Event.SourceIP
      description: The source ip.
      type: String
    - contextPath: SentinelOne.Event.SourcePort
      description: The source port.
      type: String
    - contextPath: SentinelOne.Event.DestinationIP
      description: The destination IP.
      type: String
    - contextPath: SentinelOne.Event.DestinationPort
      description: The destination port.
      type: String
    - contextPath: SentinelOne.Event.SourceProcessUser
      description: The source process user.
      type: String
    - contextPath: SentinelOne.Event.SourceProcessCommandLine
      description: The source process command line.
      type: String
    - contextPath: SentinelOne.Event.DNSRequest
      description: The DNS Request.
      type: String
    - contextPath: SentinelOne.Event.FileFullName
      description: The file full name.
      type: String
    - contextPath: SentinelOne.Event.EventTime
      description: The event time.
      type: String
    - contextPath: Event.ID
      description: Event process ID.
      type: String
    - contextPath: Event.Name
      description: Event name.
      type: String
    - contextPath: Event.Type
      description: Event type.
      type: String
    - contextPath: SentinelOne.Cursor.Event
      description: cursor to recieve next page.
      type: String
  - arguments:
    - description: The query string for which to return events.
      name: query
      required: true
    - description: Query start date, for example, "2019-08-03T04:49:26.257525Z". Limited to 93 days ago.
      name: from_date
      required: true
    - description: Query end date, for example, "2019-08-03T04:49:26.257525Z".
      name: to_date
      required: true
    description: Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.
    name: sentinelone-create-query
    outputs:
    - contextPath: SentinelOne.Query.FromDate
      description: Query start date.
      type: Date
    - contextPath: SentinelOne.Query.Query
      description: The search query string.
      type: String
    - contextPath: SentinelOne.Query.QueryID
      description: The query ID.
      type: String
    - contextPath: SentinelOne.Query.ToDate
      description: Query end date.
      type: Date
  - arguments:
    - description: 'The queryId that is returned when creating a query under Create Query. Example: "q1xx2xx3". Get the query_id from the "get-query-id" command.'
      name: query_id
      required: true
    - defaultValue: "50"
      description: Maximum number of items to return (1-100).
      name: limit
    description: Returns a list of Deep Visibility events from query by event type - process.
    name: sentinelone-get-processes
    outputs:
    - contextPath: SentinelOne.Event.ParentProcessID
      description: Parent process ID.
      type: Number
    - contextPath: SentinelOne.Event.ProcessUID
      description: The process unique identifier.
      type: String
    - contextPath: SentinelOne.Event.SHA1
      description: SHA1 hash of the process image.
      type: String
    - contextPath: SentinelOne.Event.SubsystemType
      description: Process sub-system.
      type: String
    - contextPath: SentinelOne.Event.ParentProcessStartTime
      description: The parent process start time.
      type: Date
    - contextPath: SentinelOne.Event.ProcessID
      description: The process ID.
      type: Number
    - contextPath: SentinelOne.Event.ParentProcessUID
      description: Parent process unique identifier.
      type: String
    - contextPath: SentinelOne.Event.User
      description: User assigned to the event.
      type: String
    - contextPath: SentinelOne.Event.Time
      description: Start time of the process.
      type: Date
    - contextPath: SentinelOne.Event.ParentProcessName
      description: Parent process name.
      type: String
    - contextPath: SentinelOne.Event.SiteName
      description: Site name.
      type: String
    - contextPath: SentinelOne.Event.EventType
      description: The event type.
      type: String
    - contextPath: SentinelOne.Event.Endpoint
      description: The agent name (endpoint).
      type: String
    - contextPath: SentinelOne.Event.IntegrityLevel
      description: Process integrity level.
      type: String
    - contextPath: SentinelOne.Event.CMD
      description: Process CMD.
      type: String
    - contextPath: SentinelOne.Event.ProcessName
      description: Process name.
      type: String
    - contextPath: SentinelOne.Event.ProcessDisplayName
      description: Process display name.
      type: String
  - arguments:
    - description: "A free-text search term that will match applicable attributes (sub-string match). Note: A device's physical addresses will only be matched if they start with the search term (not if they contain the search term)."
      name: query
    - description: A comma-separated list of agents IDs to shutdown.
      isArray: true
      name: agent_id
    - description: The ID of the network group.
      name: group_id
    description: Sends a shutdown command to all agents that match the input filter.
    name: sentinelone-shutdown-agent
    outputs:
    - contextPath: SentinelOne.Agent.ID
      description: The ID of the agent that was shutdown.
      type: String
  - arguments:
    - description: "A free-text search term that will match applicable attributes (sub-string match). Note: A device's physical addresses will only be matched if they start with the search term (not if they contain the search term)."
      name: query
    - description: A comma-separated list of agents IDs to shutdown.
      name: agent_id
    - description: The ID of the network group.
      name: group_id
    description: Sends an uninstall command to all agents that match the input filter.
    name: sentinelone-uninstall-agent
    outputs:
    - contextPath: SentinelOne.uninstall.Affected
      description: Number of affected agents.
      type: String
  - arguments:
    - name: verdict
      required: true
      auto: PREDEFINED
      predefined:
      - undefined
      - true_positive
      - false_positive
      - suspicious
      description: Analyst verdict action.
    - name: threat_ids
      required: true
      description: A comma-separated list of threat IDs.
      isArray: true
    description: Updates the analyst verdict to a group of threats that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-update-threats-verdict
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Updated
      description: Whether the threat was successfully updated in the analyst verdict.
      type: Boolean
    - contextPath: SentinelOne.Threat.Update.Action
      description: Name of the analyst verdict action performed on the threats.
      type: String
  - arguments:
    - name: verdict
      required: true
      auto: PREDEFINED
      predefined:
      - undefined
      - true_positive
      - false_positive
      - suspicious
      description: Analyst verdict action.
    - name: alert_ids
      required: true
      description: A comma-separated list of alert IDs.
      isArray: true
    description: Updates the analyst verdict to a group of alerts that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-update-alerts-verdict
    outputs:
    - contextPath: SentinelOne.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: SentinelOne.Alert.Updated
      description: Whether the alert was successfully updated in the analyst verdict.
      type: Boolean
    - contextPath: SentinelOne.Alert.Update.Action
      description: Name of the analyst verdict action performed on the alerts.
      type: String
  - arguments:
    - name: status
      required: true
      description: UAM alert status.
      auto: PREDEFINED
      predefined:
      - New
      - In progress
      - Resolved
    - name: alert_ids
      required: true
      description: A comma-separated list of UAM alert IDs.
      isArray: true
    description: Updates the status for a group of UAM alerts. Relevant for API version 2.1.
    name: sentinelone-update-uam-alert-status
    outputs:
    - contextPath: SentinelOne.UAMAlert.ID
      description: The UAM alert ID.
      type: String
    - contextPath: SentinelOne.UAMAlert.Updated
      description: Whether the status was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.UAMAlert.Status
      description: Name of the status performed on the alerts.
      type: String
  - arguments:
    - name: analyst_verdict
      description: 'UAM alert analyst verdict.'
      required: true
      auto: PREDEFINED
      predefined:
      - False positive - Benign
      - False positive - Benign but suspicious
      - False positive - System error
      - False positive - Undefined
      - False positive - User error
      - True positive - Advanced persistent threat
      - True positive - Benign
      - True positive - Benign but suspicious
      - True positive - Data exfiltration
      - True positive - Denial of service
      - True positive - Exploitation tools
      - True positive - Insider threat
      - True positive - Malware
      - True positive - Phishing attack
      - True positive - Policy violation
      - True positive - PUA/Adware
      - True positive - Ransomware
      - True positive - Unauthorized access
      - True positive - Undefined
      - Undefined
    - name: alert_ids
      description: 'A comma-separated list of UAM alert IDs.'
      required: true
      isArray: true
    name: sentinelone-update-uam-alert-verdict
    description: Updates the analyst verdict for a group of UAM alerts. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.UAMAlert.ID
      description: The UAM alert ID.
      type: String
    - contextPath: SentinelOne.UAMAlert.Updated
      description: Whether the analyst verdict was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.UAMAlert.AnalystVerdict
      description: Name of the analyst verdict performed on the alerts.
      type: String
  - arguments:
    - name: name
      required: true
      description: 'The name of the STAR rule.'
    - name: rule_severity
      required: true
      description: The rule severity.
      auto: PREDEFINED
      predefined:
      - Low
      - Medium
      - High
      - Critical
    - name: expiration_mode
      required: true
      auto: PREDEFINED
      predefined:
      - Permanent
      - Temporary
      description: Type of expiration mode.
    - name: query_type
      required: true
      auto: PREDEFINED
      predefined:
      - events
      - processes
      description: Type of the query. For now it's "events".
    - name: query
      required: true
      description: The query string for which to return events.
    - name: description
      description: The description of the STAR rule.
    - name: expiration_date
      description: If expiration mode is "Temporary" then it should be supplied, for example, "2019-08-03T04:49:26.257525Z".
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    - name: group_ids
      description: A comma-separated list of Group IDs.
      isArray: true
    - name: account_ids
      description: A comma-separated list of Account IDs.
      isArray: true
    - name: network_quarantine
      description: Whether to enable the network quarantine of the STAR rule.
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: treatAsThreat
      required: true
      auto: PREDEFINED
      predefined:
      - "Malicious"
      - "Suspicious"
      - UNDEFINED
      description: The treatAsThreat type.
    - name: query_lang
      auto: PREDEFINED
      predefined:
      - "1.0"
      - "2.0"
      description: The query language version. Supported values are "1.0" and "2.0".
    description: Creates a custom STAR rule. Relevant for API version 2.1.
    name: sentinelone-create-star-rule
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The STAR rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Name
      description: The STAR rule name.
      type: String
    - contextPath: SentinelOne.StarRule.Status
      description: The status of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Severity
      description: The severity of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Description
      description: The description of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.NetworkQuarantine
      description: The network quarantine of the STAR rule.
      type: Boolean
    - contextPath: SentinelOne.StarRule.TreatAsThreat
      description: The Treat As Threat of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationMode
      description: The expiration mode of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationDate
      description: The expiration date of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ScopeHierarchy
      description: The scope hierarchy of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.CreatedAt
      description: The created time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.UpdatedAt
      description: The updated time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.QueryLanguage
      description: The query language version for the STAR rule.
      type: String
  - arguments:
    - name: status
      description: 'A comma-separated list of the status of the STAR rule. Available options are: "Activating, Active, Deleted, Deleting, Disabled, Disabling and Draft".Example: "Draft,Active".'
    - name: creator_contains
      description: 'Free-text filter by rule creator (supports multiple values). Example: "Service Pack 1".'
    - name: queryType
      auto: PREDEFINED
      predefined:
      - events
      - processes
      description: 'Return rules with the filtered type. Example: "events".'
    - name: query
      description: 'Free-text filter by S1 query (supports multiple values). Example: "Service Pack 1".'
    - name: description_contains
      description: 'Free-text filter by rule description (supports multiple values). Example: "Service Pack 1".'
    - name: ruleIds
      description: 'A comma-separated list of Rules IDs. Example: "225494730938493804,225494730938493915".'
    - name: name_contains
      description: 'Free-text filter by rule name (supports multiple values). Example: "Service Pack 1".'
    - name: accountIds
      description: 'A comma-separated list of Account IDs to filter by. Example: "225494730938493804,225494730938493915".'
    - name: expirationMode
      auto: PREDEFINED
      predefined:
      - Temporary
      - Permanent
      description: 'Return rules with the filtered expiration mode. Example: "Permanent".'
    - name: limit
      description: 'Limit number of returned items (1-1000). Example: "10".'
    - name: siteIds
      description: 'A comma-separated list of site IDs to filter by. Example: "225494730938493804,225494730938493915".'
    description: Get a list of custom detection rules for a given scope. Relevant for API version 2.1.
    name: sentinelone-get-star-rules
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The STAR rule ID.
      type: Number
    - contextPath: SentinelOne.StarRule.Creator
      description: The STAR rule creator.
      type: string
    - contextPath: SentinelOne.StarRule.Name
      description: The STAR rule name.
      type: string
    - contextPath: SentinelOne.StarRule.Status
      description: The STAR rule status.
      type: string
    - contextPath: SentinelOne.StarRule.Severity
      description: The STAR rule severity.
      type: string
    - contextPath: SentinelOne.StarRule.GeneratedAlerts
      description: The number of STAR rule generated alerts.
      type: Number
    - contextPath: SentinelOne.StarRule.Description
      description: The STAR rule description.
      type: string
    - contextPath: SentinelOne.StarRule.StatusReason
      description: The STAR rule status reason.
      type: string
    - contextPath: SentinelOne.StarRule.ExpirationMode
      description: The STAR rule expiration mode.
      type: string
    - contextPath: SentinelOne.StarRule.ExpirationDate
      description: The STAR rule expiration date.
      type: Date
    - contextPath: SentinelOne.StarRule.Expired
      description: Whether the STAR rule expired.
      type: Boolean
  - arguments:
    - name: rule_id
      required: true
      description: 'Rule ID  Example: "225494730938493804".'
    - name: name
      required: true
      description: The name of the STAR rule.
    - name: rule_severity
      required: true
      auto: PREDEFINED
      predefined:
      - Low
      - Medium
      - High
      - Critical
      description: The rule severity.
    - name: expiration_mode
      required: true
      auto: PREDEFINED
      predefined:
      - Permanent
      - Temporary
      description: Type of expiration mode.
    - name: query_type
      required: true
      auto: PREDEFINED
      predefined:
      - events
      - processes
      description: Type of the query. For now it's "events".
    - name: query
      required: true
      description: The query string for which to return events.
    - name: description
      description: The description of the STAR rule.
    - name: expiration_date
      description: If expiration mode is "Temporary" then it should be supplied, for example, "2019-08-03T04:49:26.257525Z".
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    - name: group_ids
      description: A comma-separated list of group IDs.
      isArray: true
    - name: account_ids
      description: A comma-separated list of account IDs.
      isArray: true
    - name: network_quarantine
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable the network quarantine of the STAR rule.
    - name: treatAsThreat
      required: true
      auto: PREDEFINED
      predefined:
      - Malicious
      - Suspicious
      - UNDEFINED
      description: The treatAsThreat.
    - name: query_lang
      auto: PREDEFINED
      predefined:
      - "1.0"
      - "2.0"
      description: The query language version. Supported values are "1.0" and "2.0".
    description: Updates a custom STAR rule. Relevant for API version 2.1.
    name: sentinelone-update-star-rule
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The STAR rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Name
      description: The STAR rule name.
      type: String
    - contextPath: SentinelOne.StarRule.Status
      description: The status of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Severity
      description: The severity of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.Description
      description: The description of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.NetworkQuarantine
      description: The network quarantine of the STAR rule.
      type: Boolean
    - contextPath: SentinelOne.StarRule.TreatAsThreat
      description: The Treat As Threat of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationMode
      description: The expiration mode of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ExpirationDate
      description: The expiration date of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.ScopeHierarchy
      description: The scope hierarchy of the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.CreatedAt
      description: The created time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.UpdatedAt
      description: The updated time for the STAR rule.
      type: String
    - contextPath: SentinelOne.StarRule.QueryLanguage
      description: The query language version for the STAR rule.
      type: String
  - arguments:
    - name: rule_ids
      required: true
      description: A comma-separated list of STAR rule IDs.
      isArray: true
    description: Activate Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-enable-star-rules
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The Rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Enabled
      description: Whether the STAR rule was successfully enabled.
      type: Boolean
  - arguments:
    - description: A comma-separated list of STAR rule IDs.
      name: rule_ids
      required: true
      isArray: true
    description: Disable Custom Detection rules that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-disable-star-rules
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The Rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Disabled
      description: Whether the STAR rule was successfully disabled.
      type: Boolean
  - arguments:
    - description: A comma-separated list of STAR rule IDs.
      name: rule_ids
      required: true
      isArray: true
    name: sentinelone-delete-star-rule
    description: Deletes Custom Detection Rules that match the specified input filter. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.StarRule.ID
      description: The Rule ID.
      type: String
    - contextPath: SentinelOne.StarRule.Deleted
      description: Whether the STAR rule was successfully deleted.
      type: Boolean
  - arguments:
    - description: Whether the global list is accessible. (Same as `tenant` flag in API docs.).
      name: global
      auto: PREDEFINED
      defaultValue: "true"
      predefined:
      - "true"
      - "false"
    - description: Comma-separated list of group IDs to filter by.
      name: group_ids
    - description: Comma-separated list of site IDs to filter by.
      name: site_ids
    - description: Comma-separated list of account IDs to filter by.
      name: account_ids
    - description: The number of records to skip (for paging).
      name: offset
      defaultValue: "0"
    - description: The maximum number of records to return.
      name: limit
      defaultValue: "1000"
    - description: SHA1 or SHA256 hash to search for in the blocklist.
      name: hash
    - description: SHA1 hash to search for in the blocklist.
      name: sha1
    - description: SHA256 hash to search for in the blocklist.
      name: sha256Value
    description: Retrieve the blocklist ("blacklist" in SentinelOne). You can filter by SHA1 or SHA256 hash. If the `global` flag is `true`, then group_ids, site_ids, and account_ids are ignored.
    name: sentinelone-get-blocklist
    outputs:
    - contextPath: SentinelOne.Blocklist.UserId
      description: User ID.
      type: String
    - contextPath: SentinelOne.Blocklist.UpdatedAt
      description: When entry was most recently updated.
      type: String
    - contextPath: SentinelOne.Blocklist.Value
      description: File hash (SHA1 or SHA256).
      type: String
    - contextPath: SentinelOne.Blocklist.ScopePath
      description: SentinelOne list scope.
      type: String
    - contextPath: SentinelOne.Blocklist.Type
      description: Block list type.
      type: String
    - contextPath: SentinelOne.Blocklist.Source
      description: Source of entry.
      type: String
    - contextPath: SentinelOne.Blocklist.ID
      description: Entry ID.
      type: String
    - contextPath: SentinelOne.Blocklist.CreatedAt
      description: Date entry was created.
      type: String
    - contextPath: SentinelOne.Blocklist.Description
      description: Description of the blocklist.
      type: String
    - contextPath: SentinelOne.Blocklist.OSType
      description: Operating system type block is enforced on.
      type: String
    - contextPath: SentinelOne.Blocklist.ScopeName
      description: Name of the blocklist scope.
      type: String
  - arguments:
    - description: SHA1 hash to add to the blocklist.
      name: sha1
    - description: SHA256 hash to add to the blocklist.
      name: sha256Value
    - description: String describing the source of the block.
      name: source
      defaultValue: XSOAR
    - auto: PREDEFINED
      name: os_type
      predefined:
      - windows
      - linux
      - macos
      required: true
      description: Type of operating system.
    - defaultValue: Blocked from XSOAR
      description: Note stored in SentinelOne about the block.
      name: description
    - description: Comma-separated string of site IDs to scope the blocklist.
      name: site_ids
    - description: Comma-separated string of group IDs to scope the blocklist.
      name: group_ids
    - description: Comma-separated string of account IDs to scope the blocklist.
      name: account_ids
    description: Add a hash to the blocklist in SentinelOne. Supports scoping by site, group, or account. If Scope not provided, the block will be global.
    name: sentinelone-add-hash-to-blocklist
    outputs:
    - contextPath: SentinelOne.AddHashToBlocklist.hash
      description: Hash of the file.
    - contextPath: SentinelOne.AddHashToBlocklist.status
      description: Status of the action to add a hash to the blocklist.
  - arguments:
    - description: SHA1 hash to remove from the global blocklist.
      name: sha1
    - description: SHA256 hash to remove from the global blocklist.
      name: sha256Value
    - description: Optional operating system type. If not supplied, will remove the SHA1 hash across all platforms.
      name: os_type
      auto: PREDEFINED
      predefined:
      - windows
      - macos
      - linux
    - description: Comma-separated string of site IDs to scope the blocklist.
      name: site_ids
    - description: Comma-separated string of group IDs to scope the blocklist.
      name: group_ids
    - description: Comma-separated string of account IDs to scope the blocklist.
      name: account_ids
    description: Remove a hash from the global blocklist in SentinelOne.
    name: sentinelone-remove-hash-from-blocklist
    outputs:
    - contextPath: SentinelOne.RemoveHashFromBlocklist.hash
      description: Hash of the file.
    - contextPath: SentinelOne.RemoveHashFromBlocklist.status
      description: Status of the action to remove a hash from the blocklist.
  - arguments:
    - name: agent_id
      required: true
      description: Agent ID to retrieve the file from.
    - name: file_path
      required: true
      description: File path to download the file from.
    - description: Password to protect the zip file with.
      name: password
      required: true
    description: Invokes a fetch files command against an agent endpoint.
    name: sentinelone-fetch-file
  - arguments:
    - name: agent_id
      required: true
      description: SentinelOne agent ID.
      defaultValue: Agent ID
    - name: activity_id
      required: true
      description: Activity ID in the get-activities command.
    - name: password
      required: true
      description: Password used in the sentinelone-fetch-file command.
    description: Download a file fetched using th sentinelone-fetch-file command to submit the request and the sentinelone-get-activities command to get the download path.
    name: sentinelone-download-fetched-file
  - arguments:
    - name: threat_ids
      required: true
      description: A comma-separated list of threat IDs.
      isArray: true
    - name: note
      required: true
      description: Threat Note Text.
    description: Add a threat note to one or more threats. Relevant for API version 2.1.
    name: sentinelone-write-threat-note
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Note
      description: The threat note.
      type: String
    - contextPath: SentinelOne.Threat.Status
      description: Whether the note was added successfully.
      type: String
  - arguments:
    - name: name
      required: true
      description: Threat Intelligence indicator name.
    - name: source
      required: true
      description: The source of the identified Threat Intelligence indicator.
    - name: type
      required: true
      description: The type of the Threat Intelligence indicator.
      auto: PREDEFINED
      predefined:
      - DNS
      - IPV4
      - IPV6
      - MD5
      - SHA1
      - SHA256
      - URL
    - name: method
      required: true
      description: The comparison method used by SentinelOne to trigger the event.
      auto: PREDEFINED
      predefined:
      - EQUALS
    - name: validUntil
      required: true
      description: Expiration date for the Threat Intelligence indicator.
    - name: value
      required: true
      description: The value of the Threat Intelligence indicator.
    - name: account_ids
      required: true
      description: List of account IDs to filter by.
      isArray: true
    - name: externalId
      description: The unique identifier of the indicator as provided by the Threat Intelligence source.
    - name: description
      description: Description of the Threat Intelligence indicator.
    description: Add an IoC to the Threat Intelligence database. Relevant for API version 2.1.
    name: sentinelone-create-ioc
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Name
      description: Threat Intelligence indicator name.
      type: String
    - contextPath: SentinelOne.IOC.Source
      description: The source of the identified Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Type
      description: The type of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.BatchId
      description: The IOC batch ID.
      type: String
    - contextPath: SentinelOne.IOC.Creator
      description: The IOC creator.
      type: String
    - contextPath: SentinelOne.IOC.Scope
      description: The IOC scope.
      type: String
    - contextPath: SentinelOne.IOC.ScopeId
      description: The IOC scope ID.
      type: String
    - contextPath: SentinelOne.IOC.ValidUntil
      description: Expiration date for the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Description
      description: Description of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.ExternalId
      description: The unique identifier of the indicator as provided by the Threat Intelligence source.
      type: String
    compliantpolicies:
    - Domain Blockage
    - IP Blockage
  - arguments:
    - name: entry_id
      required: true
      description: Entry ID of uploaded IOCs JSON file.
    - name: account_ids
      required: true
      description: A comma-separated list of account IDs to filter by.
      isArray: true
    description: Add bulk list of IoCs to the Threat Intelligence database. Relevant for API version 2.1.
    name: sentinelone-create-bulk-ioc
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Name
      description: Threat Intelligence indicator name.
      type: String
    - contextPath: SentinelOne.IOC.Source
      description: The source of the identified Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Type
      description: The type of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.BatchId
      description: The IOC batch ID.
      type: String
    - contextPath: SentinelOne.IOC.Creator
      description: The IOC creator.
      type: String
    - contextPath: SentinelOne.IOC.Scope
      description: The IOC scope.
      type: String
    - contextPath: SentinelOne.IOC.ScopeId
      description: The IOC scope ID.
      type: String
    - contextPath: SentinelOne.IOC.ValidUntil
      description: Expiration date for the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.Description
      description: Description of the Threat Intelligence indicator.
      type: String
    - contextPath: SentinelOne.IOC.ExternalId
      description: The unique identifier of the indicator as provided by the Threat Intelligence source.
      type: String
    compliantpolicies:
    - Domain Blockage
    - IP Blockage
  - arguments:
    - name: singularity_xdr_url
      required: true
      description: Singularity Data Lake XDR URL.
    - name: singularity_xdr_api_key
      description: A Log Read Access API key.
      required: true
    - name: query
      description: 'The query, in PowerQuery syntax.'
      required: true
    - name: start_time
      description: 'Start time for your query.'
      required: false
    - name: end_time
      description: 'End time for your query.'
      required: false
    - name: priority
      description: 'Query execution priority (defaults to "low").'
      required: false
      defaultValue: low
    - name: recurring
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Optional (defaults to false). When set to true, a materialized view of your query is created.
      required: false
      defaultValue: "false"
    - name: team_emails
      description: 'Comma-separated list of account emails to query, enabling Cross Team Search.'
      isArray: true
      required: false
    description: Run a PowerQuery, where you can pipe one or many search expressions into a set of commands to transform, manipulate, group, and summarize your data.
    name: sentinelone-run-powerquery
    outputs:
    - contextPath: SentinelOne.PowerQuery.Results.status
      description: The status of the PowerQuery execution.
      type: String
    - contextPath: SentinelOne.PowerQuery.Results.matchingEvents
      description: Number of events that match the query's initial filter.
      type: Number
    - contextPath: SentinelOne.PowerQuery.Results.omittedEvents
      description: Number of events omitted from the final result due to memory limits.
      type: Number
    - contextPath: SentinelOne.PowerQuery.Results.results
      description: A list of result rows returned by the PowerQuery, where each object represents one row (column:value pairs).
      type: List
  - arguments:
    - name: account_ids
      required: true
      description: List of account IDs to filter by.
      isArray: true
    - name: uuids
      required: true
      description: UUID of Threat Intelligence indicator.
    description: Delete an IOC from the Threat Intelligence database that matches a filter. Relevant for API version 2.1.
    name: sentinelone-delete-ioc
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Deleted
      description: Whether the Threat Intelligence indicator was deleted.
      type: Boolean
  - arguments:
    - name: account_ids
      required: true
      description: List of account IDs to filter by.
      isArray: true
    - name: limit
      description: Limit number of returned items (1-1000). Default is 1000.
    - name: upload_time_gte
      description: 'The time (greater than or equal to) at which the Threat Intelligence indicator was uploaded to the SentinelOne database. Example: "2022-07-13T20:33:29.007906Z".'
    - name: upload_time_lte
      description: 'The time (less than or equal to) at which the Threat Intelligence indicator was uploaded to the SentinelOne database. Example: "2022-07-13T20:33:29.007906Z".'
    - name: cursor
      description: 'Cursor position returned by the last request. Should be used for iterating over more than 1000 items. Example: "YWdlbnRfaWQ6NTgwMjkzODE=".'
    - name: uuids
      description: 'A list of unique IDs of the parent process of the indicator of compromise. Example: "2cffae871197f20d864fe8363eee6651".'
    - name: type
      auto: PREDEFINED
      predefined:
      - DNS
      - IPV4
      - IPV6
      - MD5
      - SHA1
      - SHA256
      - URL
      description: The type of the Threat Intelligence indicator.
    - name: batch_id
      description: 'Unique ID of the uploaded indicators batch. Example: "atmtn000000028a881bcf939dc6d92ab55443".'
    - name: source
      description: 'List of the sources of the identified Threat Intelligence indicator. Example: "AlienVault".'
    - name: value
      description: 'The value of the Threat Intelligence indicator. Example: "175.0.x.x".'
    - name: external_id
      description: 'The unique identifier of the indicator as provided by the Threat Intelligence source. Example: "e277603e-1060-5ad4-9937-c26c97f1ca68".'
    - name: name_contains
      description: 'A comma-separated list of free-text filtered by the indicator name. Example: "foo.dll".'
    - name: creator_contains
      description: 'A comma-separated list of free-text filtered by the user who uploaded the Threat Intelligence indicator. Example: "admin@sentinelone.com".'
    - name: category_in
      description: "The categories of the Threat Intelligence indicator. Example: The malware type associated with the IOC."
    - name: description_contains
      description: 'A comma-separated list of free-text filtered by the description of the indicator. Example: "Malicious-activity".'
    - name: updated_at_gte
      description: 'The time (greater or equal to) at which the indicator was last updated in the SentinelOne database. Example: "2021-07-13T20:33:29.007906Z".'
    - name: updated_at_lte
      description: 'The time (less than or equal to) at which the indicator was last updated in the SentinelOne database. Example: "2021-07-13T20:33:29.007906Z".'
    - name: creation_time_gte
      description: 'Creation time (greater than or equal to) as set by the user. Example: "2021-07-13T20:33:29.007906Z".'
    - name: creation_time_lte
      description: 'Creation time (less than or equal to) as set by the user. Example: "2021-07-13T20:33:29.007906Z".'
    description: Get the IOCs of a specified account that match the filter. Relevant for API version 2.1.
    name: sentinelone-get-iocs
    outputs:
    - contextPath: SentinelOne.IOC.UUID
      description: The IOC UUID.
      type: String
    - contextPath: SentinelOne.IOC.Creator
      description: Threat Intelligence indicator creator.
      type: String
    - contextPath: SentinelOne.IOC.Name
      description: Threat Intelligence indicator name.
      type: String
    - contextPath: SentinelOne.IOC.Value
      description: Threat Intelligence indicator value.
      type: String
    - contextPath: SentinelOne.IOC.Description
      description: Threat Intelligence indicator description.
      type: String
    - contextPath: SentinelOne.IOC.Type
      description: Threat Intelligence indicator type.
      type: String
    - contextPath: SentinelOne.IOC.ExternalId
      description: Threat Intelligence indicator external ID.
      type: String
    - contextPath: SentinelOne.IOC.Source
      description: Threat Intelligence indicator source.
      type: String
    - contextPath: SentinelOne.IOC.UploadTime
      description: Threat Intelligence indicator upload time.
      type: String
    - contextPath: SentinelOne.IOC.ValidUntil
      description: Threat Intelligence indicator expiration time.
      type: String
  - arguments:
    - name: query
      required: true
      description: Events matching the query search term will be returned.
    - name: from_date
      required: true
      description: Events created after this timestamp.
    - name: to_date
      required: true
      description: Events created before or at this timestamp.
    - name: limit
      description: Limit number of returned items (1-100000).
    description: Deprecated. Use ***sentinelone-get-power-query-results*** instead. Start a Deep Visibility Power query to get back status and potential results (ping afterwards using the queryId if query has not finished). Relevant for API version 2.1.
    name: sentinelone-create-power-query
    deprecated: true
  - arguments:
    - name: queryId
      required: true
      description: QueryId.
    description: Deprecated. Use ***sentinelone-get-power-query-results*** instead. Ping a Deep Visibility Power query using the queryId argument if results have not returned from an initial Power query or a previous ping. Relevant for API version 2.1.
    name: sentinelone-ping-power-query
    deprecated: true
  - arguments:
    - name: status
      required: true
      description: Incident status.
      auto: PREDEFINED
      predefined:
      - in_progress
      - resolved
      - unresolved
    - name: threat_ids
      required: true
      description: A comma-separated list of threat IDs.
      isArray: true
    description: Updates the incident status to a group of threats that match the specified input filter. Relevant for API version 2.1.
    name: sentinelone-update-threats-status
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Updated
      description: Whether the threat was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.Threat.Status
      description: Name of the status performed on the threats.
      type: String
  - arguments:
    - name: status
      required: true
      description: "Incident status."
      auto: PREDEFINED
      predefined:
      - in_progress
      - resolved
      - unresolved
    - name: alert_ids
      required: true
      description: A comma-separated list of alert IDs.
      isArray: true
    name: sentinelone-update-alerts-status
    description: Updates the incident status to a group of alerts that match the specified input filter. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Alert.ID
      description: The alert ID.
      type: String
    - contextPath: SentinelOne.Alert.Updated
      description: Whether the alert was successfully updated.
      type: Boolean
    - contextPath: SentinelOne.Alert.Status
      description: The status performed on the alerts.
      type: String
  - arguments:
    - name: site_id
      required: true
      description: 'A valid site ID.'
    name: sentinelone-expire-site
    description: Expire the site of the given ID.
    outputs:
    - contextPath: SentinelOne.Site.ID
      description: The site ID.
      type: String
    - contextPath: SentinelOne.Site.Name
      description: The site name.
      type: String
    - contextPath: SentinelOne.Site.State
      description: The site state.
      type: String
    - contextPath: SentinelOne.Site.SKU
      description: The SKU of product features active for this site.
      type: String
    - contextPath: SentinelOne.Site.SiteType
      description: The site type.
      type: String
    - contextPath: SentinelOne.Site.Suite
      description: The site suite.
      type: String
    - contextPath: SentinelOne.Site.TotalLicenses
      description: The total licenses.
      type: String
    - contextPath: SentinelOne.Site.AccountID
      description: The account ID.
      type: String
    - contextPath: SentinelOne.Site.Creator
      description: Full name of the creating user.
      type: String
    - contextPath: SentinelOne.Site.CreatorID
      description: ID of the creating user.
      type: String
    - contextPath: SentinelOne.Site.Description
      description: Description of the site.
      type: String
    - contextPath: SentinelOne.Site.Expiration
      description: Expiration date of the site.
      type: String
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    - name: password
      required: true
      description: File encryption password. (At least 10 characters, three out of this list "uppercase", "lowercase", "digits" and "symbols" are mandatory. Maximum length is 256 characters.).
    name: sentinelone-fetch-threat-file
    description: Fetch a file associated with the threat that matches the filter.
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Downloadable
      description: Whether the file is downloadable.
      type: Boolean
    - contextPath: SentinelOne.Threat.ZippedFile
      description: Details of the zipped folder.
      type: String
  - arguments:
    - name: created_from
      required: true
      description: 'Greater than or equal to the time created. Example: "2018-02-27T04:49:26.257525Z", "10 days", "2 hours","5 months".'
    - name: created_until
      description: 'Less than or equal to the time created. Example: "2018-02-27T04:49:26.257525Z", "10 days", "2 hours","5 months".'
    - name: ruleName
      description: 'Free-text filter by rule name. Example: "rule1".'
    - name: incidentStatus
      description: 'Incident status. Example: "IN_PROGRESS".'
    - name: analystVerdict
      description: 'Analyst verdict. Example: "TRUE_POSITIVE".'
    - name: alert_ids
      description: A comma-separated list of alert IDs.
    - name: limit
      description: Limit number of returned items (1-1000). Default is 1000.
    - name: site_ids
      description: 'A comma-separated list of site IDs to filter by. Example: "225494730938493804,225494730938493915".'
    - name: cursor
      description: 'Cursor position returned by the last request. Should be used for iterating over more than 1000 items. Example: "YWdlbnRfaWQ6NTgwMjkzODE=".'
    name: sentinelone-get-alerts
    description: Get the list of alerts that matches the filter provided. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Alert.EventType
      description: Event type.
      type: String
    - contextPath: SentinelOne.Alert.RuleName
      description: The rule name.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcUser
      description: Source process user.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcName
      description: Source process name.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcPath
      description: Source process file path.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcCommandline
      description: The command line.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcSHA1
      description: Source process SHA1 file hash.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcStartTime
      description: PID start time.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcStorylineId
      description: Source process story line ID.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcName
      description: Source parent process name.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcPath
      description: Source parent process file path.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcCommandline
      description: Source parent process command line.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcStartTime
      description: PID start time.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcUser
      description: Source parent process user.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcSHA1
      description: Source parent process SHA1 file hash.
      type: String
    - contextPath: SentinelOne.Alert.SrcProcSignerIdentity
      description: Source process file signer identity.
      type: String
    - contextPath: SentinelOne.Alert.SrcParentProcSignerIdentity
      description: Source parent process file signer identity.
      type: String
    - contextPath: SentinelOne.Alert.AlertCreatedAt
      description: The the alert was created.
      type: String
    - contextPath: SentinelOne.Alert.AlertId
      description: Alert ID.
      type: String
    - contextPath: SentinelOne.Alert.AnalystVerdict
      description: Analyst verdict.
      type: String
    - contextPath: SentinelOne.Alert.IncidentStatus
      description: Incident status.
      type: String
    - contextPath: SentinelOne.Alert.EndpointName
      description: Endpoint name.
      type: String
    - contextPath: SentinelOne.Alert.AgentId
      description: Agent ID.
      type: String
    - contextPath: SentinelOne.Alert.AgentUUID
      description: Agent UUID.
      type: String
    - contextPath: SentinelOne.Alert.dvEventId
      description: Deep Visibility event ID.
      type: String
    - contextPath: SentinelOne.Alert.AgentOS
      description: Agent operating system.
      type: String
    - contextPath: SentinelOne.Alert.AgentVersion
      description: Agent version.
      type: String
    - contextPath: SentinelOne.Alert.SiteId
      description: Site ID.
      type: String
    - contextPath: SentinelOne.Alert.RuleId
      description: Rule ID.
      type: String
  - arguments:
    - name: agent_ids
      required: true
      description: "A comma-separated list of agent IDs. Example: 14629133470822878,14627455454652878."
    name: sentinelone-get-installed-applications
    description: Get the installed applications for a specific agent.
    outputs:
    - contextPath: SentinelOne.Application.Name
      description: The application name.
      type: String
    - contextPath: SentinelOne.Application.Publisher
      description: The publisher.
      type: String
    - contextPath: SentinelOne.Application.Size
      description: The size of the application in bytes.
      type: String
    - contextPath: SentinelOne.Application.Version
      description: The version of the application.
      type: String
    - contextPath: SentinelOne.Application.InstalledOn
      description: The date the application was installed.
      type: String
  - arguments:
    - name: agent_ids
      required: true
      description: "A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878."
    name: sentinelone-initiate-endpoint-scan
    description: Initiate the endpoint virus scan on provided agent IDs.
    outputs:
    - contextPath: SentinelOne.Agent.AgentID
      description: The Agent ID.
      type: String
    - contextPath: SentinelOne.Agent.Initiated
      description: Whether the scan was initiated.
      type: Boolean
  - arguments:
    - description: "A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878."
      name: agent_ids
      required: true
    description: Abort the endpoint virus scan on provided agent IDs.
    name: sentinelone-abort-endpoint-scan
    outputs:
    - contextPath: SentinelOne.Agent.AgentID
      description: The Agent ID.
      type: String
    - contextPath: SentinelOne.Agent.Aborted
      description: Whether the scan was aborted.
      type: Boolean
  - arguments:
    - name: agent_ids
      required: true
      description: "A comma-separated list of Agent IDs. Example: 14629133470822878,14627455454652878."
    - name: agents_logs
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: 'Fetch Agent logs.'
      defaultValue: "true"
    - name: customer_facing_logs
      required: true
      description: Fetch customer-facing logs.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    - name: platform_logs
      required: true
      description: Actively fetch logs from the relevant platform (Windows, macOS, or Linux).
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    outputs:
    - contextPath: SentinelOne.Agent.Affected
      description: Number of affected endpoints.
      type: String
    description: Get the Agent and Endpoint logs from Agents for provided agent IDs.
    name: sentinelone-endpoint-fetch-logs
  - arguments:
    - name: item
      description: "Value of the item to be removed from the exclusion list."
      required: true
    - name: os_type
      description: OS type. Can be "windows", "windows_legacy", "macos", or "linux".
      auto: PREDEFINED
      predefined:
      - windows
      - windows_legacy
      - macos
      - linux
    - name: exclusion_type
      description: "Exclusion item type. The options are: file_type, path, white_hash, certificate, or browser."
    outputs:
    - contextPath: SentinelOne.RemoveItemFromWhitelist.status
      description: Status on if items were removed from whitelist or not found on whitelist.
      type: String
    - contextPath: SentinelOne.RemoveItemFromWhitelist.item
      description: Item removed fom whitelist.
      type: String
    description: Remove an item from the SentinelOne exclusion list.
    name: sentinelone-remove-item-from-whitelist
  - arguments:
    - name: account_ids
      isArray: true
      description: A comma-separated list of account IDs.
      required: true
    - name: output_destination
      required: true
      description: 'Output destination. Possible values: DataSetCloud/Local/None/SentinelCloud.'
      auto: PREDEFINED
      predefined:
      - DataSetCloud
      - Local
      - None
      - SentinelCloud
    - name: task_description
      required: true
      description: Task description.
    - name: script_id
      required: true
      description: Script ID.
    - name: output_directory
      description: Output directory.
    - name: agent_ids
      required: true
      description: A comma-separated list of agent IDs on which the script should run.
      isArray: true
    - name: singularity_xdr_Keyword
      description: Singularityxdr keyword.
    - name: singularity_xdr_Url
      description: Singularityxdr url.
    - name: api_key
      description: Api key.
    - name: input_params
      description: Input params.
    - name: password
      description: Password.
    - name: script_runtime_timeout_seconds
      description: Script runtime timout in seconds for current execution.
    - auto: PREDEFINED
      defaultValue: "false"
      description: If set to true, execution will require approval.
      name: requires_approval
      predefined:
      - "false"
      - "true"
    outputs:
    - contextPath: SentinelOne.RunRemoteScript.pendingExecutionId
      description: ID of the created pending execution. Present only if pending flag is true.
      type: string
    - contextPath: SentinelOne.RunRemoteScript.pending
      description: Flag indicating if the requested script execution requires approval and is created as a pending execution.
      type: boolean
    - contextPath: SentinelOne.RunRemoteScript.affected
      description: Number of entities affected by the requested operation.
      type: number
    - contextPath: SentinelOne.RunRemoteScript.parentTaskId
      description: The parent task ID of the script execution task. Null in case of pending execution.
      type: string
    description: Run a remote script that was uploaded to the SentinelOne Script Library.
    name: sentinelone-run-remote-script
  - arguments:
    - name: account_ids
      description: "A comma-separated list of account IDs. Example: '225494730938493804,225494730938493915'."
      isArray: true
    - name: computer_name_contains
      description: Free-text filter by agent computer name (supports multiple values).
    - name: count_only
      description: If true, only total number of items will be returned, without any of the actual objects.
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
    - name: created_at_gt
      description: "Created at greater than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: created_at_gte
      description: "Created at greater or equal than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: created_at_lt
      description: "Created at lesser than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: created_at_lte
      description: "Created at lesser or equal than timedate. Example: '2018-02-27T04:49:26.257525Z'."
    - name: cursor
      description: "Cursor position returned by the last request. Use to iterate over more than 1000 items. Example: 'YWdlbnRfaWQ6NTgwMjkzODE='."
    - name: description_contains
      description: Only include tasks with specific description.
    - name: detailed_status_contains
      description: Only include tasks with specific detailed status.
      isArray: true
    - name: group_ids
      description: "Comma-separated list of Group IDs to filter by. Example: '225494730938493804,225494730938493915'."
      isArray: true
    - name: ids
      description: "Comma-separated list of IDs to filter by. Example: '225494730938493804,225494730938493915'."
      isArray: true
    - description: Only include tasks from specific initiating user.
      name: initiated_by_contains
      isArray: true
    - description: "Limit number of returned items (1-1000). Example: '10'."
      name: limit
    - description: "Parent task ID to fetch the status by. Example: '225494730938493804'."
      name: parent_task_id
      required: true
    - description: "List of IDs to filter by."
      name: parent_task_id_in
      isArray: true
    - name: query
      description: Query.
    - name: site_ids
      isArray: true
      description: "List of site IDs to filter by. Example: '225494730938493804,225494730938493915'."
    - name: status
      description: "Status of the script task. Example: 'created'."
    - name: tenant
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Indicates a tenant scope request.
    - name: updated_at_gt
      description: "Updated at greater than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: updated_at_gte
      description: "Updated at greater or equal than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: updated_at_lt
      description: "Updated at lesser than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: updated_at_lte
      description: "Updated at lesser or equal than datetime. Example: '2018-02-27T04:49:26.257525Z'."
    - name: uuid_contains
      description: Free-text filter by agent UUID (supports multiple values).
    description: Get remote scripts tasks using a variety of filters.
    name: sentinelone-get-remote-script-task-status
    outputs:
    - contextPath: SentinelOne.GetRemoteScript.id
      description: ID of the task.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.accountId
      description: Account ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.accountName
      description: Account name where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentId
      description: Agent ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentIsActive
      description: The status of the agent.
      type: boolean
    - contextPath: SentinelOne.GetRemoteScript.agentMachineType
      description: Agent machine yype.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentOsType
      description: Agent operating system type.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.agentUuid
      description: Agent UUID.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.createdAt
      description: The script created At datetime.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.description
      description: The description of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.detailedStatus
      description: The detailed status of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.groupId
      description: Group ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.groupName
      description: Group Name where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.initiatedBy
      description: Remote script initiate by.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.initiatedById
      description: ID of the remote script initiator.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.parentTaskId
      description: Parent task ID of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.siteId
      description: Site ID where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.siteName
      description: Site name where this script is executed.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.status
      description: Status of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.statusCode
      description: Status code of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.statusDescription
      description: Status description of the remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.type
      description: Type of remote script.
      type: string
    - contextPath: SentinelOne.GetRemoteScript.updateAt
      description: Remote script upated at.
      type: string
  - arguments:
    - name: computer_names
      description: A comma-separated list of partial or whole computer names, which ran scripts, to get a download link for.
      isArray: true
    - name: task_ids
      description: A comma-separated list of task IDs to get a download link for.
      isArray: true
      required: true
    description: Get a script's result download URL.
    name: sentinelone-get-remote-script-task-results
    outputs:
    - contextPath: SentinelOne.RemoteScriptResults.taskId
      description: ID of the task.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.fileName
      description: File name.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.downloadUrl
      description: Download URL.
      type: string
  - arguments:
    - name: account_ids
      required: true
      description: A comma-separated list of account IDs.
      isArray: true
    - name: output_destination
      required: true
      auto: PREDEFINED
      predefined:
      - DataSetCloud
      - Local
      - None
      - SentinelCloud
      description: Output destination.
    - name: task_description
      required: true
      description: Task description.
    - name: script_id
      required: true
      description: Script ID.
    - name: output_directory
      description: Output directory.
    - name: agent_ids
      required: true
      description: A comma-separated list of agent IDs on which the script should run.
      isArray: true
    - name: singularity_xdr_Keyword
      description: Singularity XDR keyword.
    - name: singularity_xdr_Url
      description: Singularity XDR URL.
    - name: api_key
      description: API key.
    - name: input_params
      description: Input parameters.
    - name: password
      description: Password.
    - name: script_runtime_timeout_seconds
      description: Script runtime timout in seconds for current execution.
    - auto: PREDEFINED
      defaultValue: "false"
      description: If set to true, execution will require approval.
      name: requires_approval
      predefined:
      - "false"
      - "true"
    - defaultValue: '60'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds.
      name: interval
    - defaultValue: '600'
      description: Indicates the time in seconds until the polling sequence timeouts.
      name: timeout
    - description: "Parent task ID to fetch the status by. Example: '225494730938493804'."
      name: parent_task_id
    description: Automate a remote script's execution cycle and return the script's results.
    name: sentinelone-remote-script-automate-results
    outputs:
    - contextPath: SentinelOne.RemoteScriptResults.taskId
      description: ID of the task.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.fileName
      description: File name.
      type: string
    - contextPath: SentinelOne.RemoteScriptResults.downloadUrl
      description: Download URL.
      type: string
    polling: true
  - arguments:
    - name: account_ids
      description: A comma-separated list of account IDs.
      isArray: true
    - name: site_ids
      description: A comma-separated list of site IDs on which the query should run.
      isArray: true
    - name: query
      required: true
      description: Events matching the query search term will be returned.
    - name: from_date
      required: true
      description: "Events created after this date. Example: '2018-02-27T04:49:26.257525Z'."
    - name: to_date
      required: true
      description: "Events created before or at this date. Example: '2018-02-27T04:49:26.257525Z'."
    - name: limit
      description: Limit number of returned items (1-100000).
    - defaultValue: '10'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds.
      name: interval
    - defaultValue: '300'
      description: Indicates the time in seconds until the polling sequence timeouts.
      name: timeout
    - name: query_id
      description: "QueryId. Example: pq3be5e2747f716cxxxxxxxxxxxxx20a0."
    description: Automate a power query and return the query results. (The maximum timeout of 300 seconds is allowed.)
    name: sentinelone-get-power-query-results
    outputs:
    - contextPath: SentinelOne.PowerQuery.ResultIndex
      description: Result from the power query in list of objects format.
      type: List
    polling: true
  - arguments: []
    description: Returns the list of fields for an incident type.
    name: get-mapping-fields
  - arguments: []
    description: Pushes local changes to the remote system.
    name: update-remote-system
  - arguments:
    - description: 'The ticket ID.'
      name: id
      required: true
    - description: Retrieve entries that were created after lastUpdate.
      name: lastUpdate
      required: true
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
    name: get-remote-data
  - arguments:
    - description: Retrieve entries that were created after lastUpdate.
      name: last_update
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
    name: get-modified-remote-data
  - arguments:
    - description: 'The queryId that is returned when creating a query under Create Query. Example: "q1xx2xx3". Get the query_id from the "get-query-id" command.'
      name: query_id
      required: true
    description: Returns status of a Deep Visibility Query.
    name: sentinelone-get-dv-query-status
    outputs:
    - contextPath: SentinelOne.Query.Status.progressStatus
      description: Progress Query Status.
    - contextPath: SentinelOne.Query.Status.queryModeInfo.lastActivatedAt
      description: Last Activated At.
    - contextPath: SentinelOne.Query.Status.queryModeInfo.mode
      description: Query Mode.
    - contextPath: SentinelOne.Query.Status.responseState
      description: State of the Query.
    - contextPath: SentinelOne.Query.Status.warnings
      description: Warnings during Query.
    - contextPath: SentinelOne.Query.Status.QueryId
      description: QueryID From Request.
  - arguments:
    - name: agent_id
      description: AgentId of the System.
      required: true
    description: Returns network interface details for a given Agent ID. This includes MAC address details and interface description.
    name: sentinelone-get-agent-mac
    outputs:
    - contextPath: SentinelOne.MAC
      description: Agent network interface details.
    - contextPath: SentinelOne.MAC.agent_id
      description: AgentID.
    - contextPath: SentinelOne.MAC.hostname
      description: Hostname.
    - contextPath: SentinelOne.MAC.int_name
      description: Interface Name.
    - contextPath: SentinelOne.MAC.ip
      description: IP Address.
    - contextPath: SentinelOne.MAC.mac
      description: MAC Address.
  - arguments:
    - name: account_id
      description: Can filter on one account ID. Otherwise, it returns information from all accounts.
      required: false
    description: Returns details of accounts.
    name: sentinelone-get-accounts
    outputs:
    - contextPath: SentinelOne.Accounts.AccountType
      description: The account type.
      type: string
    - contextPath: SentinelOne.Accounts.ActiveAgents
      description: The account number of active agents.
      type: number
    - contextPath: SentinelOne.Accounts.NumberOfSites
      description: The account number of sites.
      type: number
    - contextPath: SentinelOne.Accounts.State
      description: The account state.
      type: string
    - contextPath: SentinelOne.Accounts.CreatedAt
      description: The account creation date.
      type: string
    - contextPath: SentinelOne.Accounts.Expiration
      description: The account expiration date.
      type: string
    - contextPath: SentinelOne.Accounts.ID
      description: The account ID.
      type: string
    - contextPath: SentinelOne.Accounts.Name
      description: The account name.
      type: string
  - arguments:
    - description: A comma-separated list of account IDs.
      name: account_ids
      isArray: true
    - name: application_catalog_id
      description: Filter results by application catalog id.
    - name: creator_contains
      description: Free-text filter by application creator.
    - name: ids
      description: A comma-separated list of applications IDs.
      isArray: true
    - name: name_contains
      description: Free-text filter by application name.
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    description: Returns all installed singularity marketplace applications that match the specified filter values.
    name: sentinelone-list-installed-singularity-marketplace-applications
    outputs:
    - contextPath: SentinelOne.InstalledApps.ID
      description: The application ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.Account
      description: The account name.
      type: string
    - contextPath: SentinelOne.InstalledApps.AccountId
      description: The account ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ApplicationCatalogId
      description: The application Catalog ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ApplicationCatalogName
      description: The application Catalog name.
      type: string
    - contextPath: SentinelOne.InstalledApps.AlertMessage
      description: The alert message.
      type: string
    - contextPath: SentinelOne.InstalledApps.CreatedAt
      description: Application created at.
      type: date
    - contextPath: SentinelOne.InstalledApps.Creator
      description: Application creator.
      type: string
    - contextPath: SentinelOne.InstalledApps.CreatorId
      description: Application creator ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.DesiredStatus
      description: Application desired status.
      type: string
    - contextPath: SentinelOne.InstalledApps.HasAlert
      description: Application has alert.
      type: boolean
    - contextPath: SentinelOne.InstalledApps.LastEntityCreatedAt
      description: Application last entity created at.
      type: date
    - contextPath: SentinelOne.InstalledApps.Modifier
      description: Modifier.
      type: string
    - contextPath: SentinelOne.InstalledApps.ModifierId
      description: Modifier ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ScopeId
      description: The scope ID.
      type: string
    - contextPath: SentinelOne.InstalledApps.ScopeLevel
      description: The scope level.
      type: string
    - contextPath: SentinelOne.InstalledApps.Status
      description: Status of application.
      type: string
    - contextPath: SentinelOne.InstalledApps.UpdatedAt
      description: Application updated at.
      type: string
    - contextPath: SentinelOne.InstalledApps.ApplicationInstanceName
      description: Application instance name.
      type: string
  - arguments:
    - name: account_ids
      description: "A comma-separated list of account IDs."
      isArray: true
    - name: role_ids
      description: A comma-separated list of rbac roles to filter by.
      isArray: true
    - name: ids
      description: A comma-separated list of service user IDs to filter by.
      isArray: true
    - name: site_ids
      description: A comma-separated list of site IDs.
      isArray: true
    name: sentinelone-get-service-users
    description: Returns all service users that match the specified filter values.
    outputs:
    - contextPath: SentinelOne.ServiceUsers.ID
      description: The service user ID.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ApiTokenCreatedAt
      description: Api token created at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.ApiTokenExpiresAt
      description: Api token expires at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.CreatedAt
      description: Service user created at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.CreatedById
      description: The service user created by Id.
      type: string
    - contextPath: SentinelOne.ServiceUsers.CreatedByName
      description: The service user created by name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.Description
      description: Service user description.
      type: string
    - contextPath: SentinelOne.ServiceUsers.LastActivation
      description: Last activation date.
      type: date
    - contextPath: SentinelOne.ServiceUsers.Name
      description: Service user name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.Scope
      description: Service user scope.
      type: string
    - contextPath: SentinelOne.ServiceUsers.UpdatedAt
      description: Service user updated at.
      type: date
    - contextPath: SentinelOne.ServiceUsers.UpdatedById
      description: Service user updated by Id.
      type: string
    - contextPath: SentinelOne.ServiceUsers.UpdatedByName
      description: Service user updated by name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesRoleId
      description: Scope roles role Id.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesRoleName
      description: Scope roles role name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesAccountName
      description: Scope roles account name.
      type: string
    - contextPath: SentinelOne.ServiceUsers.ScopeRolesId
      description: Scope roles Id.
      type: string
  - arguments:
    - description: The ID of the threat.
      name: threat_id
      required: true
    description: Returns threat notes.
    name: sentinelone-get-threat-notes
    outputs:
    - contextPath: SentinelOne.Notes.CreatedAt
      description: The note creation date.
      type: string
    - contextPath: SentinelOne.Notes.Creator
      description: The note creator.
      type: string
    - contextPath: SentinelOne.Notes.CreatorID
      description: The note creator ID.
      type: string
    - contextPath: SentinelOne.Notes.Edited
      description: Whether the note was edited or not.
      type: boolean
    - contextPath: SentinelOne.Notes.ID
      description: The note ID.
      type: string
    - contextPath: SentinelOne.Notes.Text
      description: The note text.
      type: string
    - contextPath: SentinelOne.Notes.UpdatedAt
      description: The note updated time.
      type: string
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    name: sentinelone-threat-download-from-cloud
    description: Download a file associated with the threat from the Cloud (BinaryVault).
    outputs:
    - contextPath: SentinelOne.Threat.ID
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Threat.Downloadable
      description: Whether the file is downloadable.
      type: Boolean
    - contextPath: SentinelOne.Threat.ZippedFile
      description: Details of the zipped folder.
      type: String
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    - name: limit
      required: false
      description: "The max number of timeline entries to return, default is 5000."
    name: sentinelone-export-full-threat-timeline
    description: Exports the threat's full timeline as a JSON File. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Export.Timeline.ThreatId
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Export.Timeline.Filename
      description: The name of the file containing the Timeline.
      type: Boolean
  - arguments:
    - name: threat_id
      required: true
      description: "Please provide the Valid Threat ID. Example: 14629133470822878."
    name: sentinelone-export-threat-events
    description: Exports the threat's events as a JSON File. Relevant for API version 2.1.
    outputs:
    - contextPath: SentinelOne.Export.Events.ThreatId
      description: The threat ID.
      type: String
    - contextPath: SentinelOne.Export.Events.Filename
      description: The name of the file containing the Timeline.
      type: Boolean
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: ""
  type: python
  subtype: python3
tests:
- SentinelOne V2.1 - Test
- SentinelOne V2.0 - Test
fromversion: 5.0.0
defaultclassifier: SentinelOne Classifier
defaultmapperin: SentinelOne Incoming Mapper
defaultmapperout: SentinelOne - Outgoing Mapper