feat(sentinelone): investigate_alert, one call for an agent (1.19.0)

Browse Source

Wraith spent ten calls on a real unified alert and still lost the host:
it took the UAM asset id for an agent id and the raw agent list ran past
what a tool result carries. investigate_alert reads the alert, its
detail, the host's agent (by id or UUID, then name), the other alerts
and threats on that host around the detection, and the file SHA1's
reputation, blocklist and fleet-wide threats, summarised in one answer.
The operator sheet now starts with it (budget 8).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

...

This commit is contained in:

Claude

2026-10-12 11:27:36 +00:00

parent 80de5399a6

commit 6f51520fb5

3 changed files with 455 additions and 39 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

integrations/sentinelone/manifest.yaml

+14 -2

File diff suppressed because one or more lines are too long