category: Analytics & SIEM
provider: SentinelOne
commonfields:
  id: SentinelOneEventCollector
  version: -1
configuration:
- display: Server URL (e.g., https://usea1.sentinelone.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: ''
  name: credentials
  required: true
  type: 9
  hiddenusername: true
  displaypassword: API Token
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Fetch events
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: Activities, Threats, Alerts
  display: Event types
  name: event_type
  options:
  - Activities
  - Threats
  - Alerts
  type: 16
  section: Collect
  required: false
- defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 1000
  display: The maximum number of events per fetch should be between 1-1000
  additionalinfo: The limit is per event type. For example, if you choose 3 event types (ACTIVITIES, THREATS, ALERTS) with a limit of 100, the actually limit will be 300.
  name: fetch_limit
  type: 0
  section: Collect
  required: false
description: This integration fetches activities, threats, and alerts from SentinelOne.
display: SentinelOne Activity and Alerts
name: SentinelOneEventCollector
supportlevelheader: xsoar
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
    - defaultValue: 1000
      description: Maximum number of results to return. Value should be between 1 - 1000.
      name: limit
    description: Gets events from SentinelOne.
    name: sentinelone-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
sectionorder:
- Connect
- Collect
supportedModules:
- xsiam