feat: SentinelOne SDL + VirusTotal Hunting integrations
SentinelOne SDL (endpoint): Unified Alerts via the GraphQL API. Alert ingestion (get_alerts) with rich filtering and an exhaustive OCSF mapper + 'SentinelOne SDL Alert' default type, full alert details, update (status/verdict/assignee), add note and trigger mitigation action. ApiToken auth; watermark converted to epoch ms for the detectedAt filter; alert edges flattened to nodes for ingestion. VirusTotal Hunting (enrichment, Premium): Livehunt notification-file ingestion (livehunt_files) with an OCSF mapper + 'VirusTotal Hunting File' default type (severity bucketed from malicious AV detections), Livehunt notifications listing, and Retrohunt job + matching-file listing. The core VT v3 reputation already ships as 'virustotal'; the XSOAR-feed and Premium file-download/zip/pcap commands were intentionally left out. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,119 @@
|
||||
id: sentinelone_sdl
|
||||
name: SentinelOne SDL
|
||||
version: 1.0.0
|
||||
description: "SentinelOne SDL (Security Data Lake) Unified Alerts via the GraphQL API — alert ingestion with rich filtering, full alert details, status/verdict/assignee updates, analyst notes and mitigation actions."
|
||||
changelog: "1.0.0 — Initial release: unified alert ingestion (get_alerts) with an exhaustive OCSF mapper, alert details, update (status/verdict/assignee), add note and trigger mitigation action."
|
||||
category: endpoint
|
||||
|
||||
# Per-instance configuration. The Unified Alerts GraphQL endpoint is on the
|
||||
# tenant console URL; authentication uses an API token (ApiToken scheme).
|
||||
config_schema:
|
||||
properties:
|
||||
url:
|
||||
type: string
|
||||
description: "SentinelOne console URL, e.g. https://tenant.sentinelone.net"
|
||||
api_token:
|
||||
type: string
|
||||
description: "SentinelOne API token"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- url
|
||||
- api_token
|
||||
|
||||
auth:
|
||||
- id: apitoken
|
||||
type: api_key
|
||||
in: header
|
||||
name: Authorization
|
||||
value_template: "ApiToken {{secret}}"
|
||||
secret_field: api_token
|
||||
|
||||
commands:
|
||||
# ── Ingestion ───────────────────────────────────────────────────────────────
|
||||
- id: get_alerts
|
||||
name: sentinelone-sdl-get-alerts
|
||||
description: "Fetch Unified Alerts with optional filters. Used for ingestion: results path = data (edges are flattened to alert nodes)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
severity: { type: string, description: "Comma-separated severities (CRITICAL,HIGH,MEDIUM,LOW,INFO)" }
|
||||
status: { type: string, description: "Comma-separated statuses (NEW,IN_PROGRESS,RESOLVED)" }
|
||||
classification: { type: string, description: "Comma-separated classifications (MALWARE,RANSOMWARE,TROJAN,...)" }
|
||||
os_type: { type: string, description: "Comma-separated OS types (WINDOWS,LINUX,MACOS)" }
|
||||
attack_surface: { type: string, description: "Comma-separated attack surfaces (ENDPOINT,CLOUD,IDENTITY,NETWORK,EMAIL)" }
|
||||
analyst_verdict: { type: string, description: "Comma-separated analyst verdicts" }
|
||||
asset_id: { type: string, description: "Filter by asset ID" }
|
||||
external_id: { type: string, description: "Filter by external ID" }
|
||||
search_text: { type: string, description: "Full-text search on the alert name" }
|
||||
start_time: { type: string, description: "Lower bound on detectedAt (ISO-8601, epoch, or relative like '24 hours'). Incremental fetch watermark." }
|
||||
end_time: { type: string, description: "Upper bound on detectedAt (ISO-8601, epoch, or relative)" }
|
||||
unassigned_only: { type: string, description: "Only unassigned alerts (true/false)" }
|
||||
unmitigated_only: { type: string, description: "Only unmitigated alerts (true/false)" }
|
||||
limit: { type: number, description: "Maximum number of alerts (default 50, max 200)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
ingest:
|
||||
results_path: data
|
||||
dedup_key: id
|
||||
incremental_field: start_time
|
||||
|
||||
- id: get_alert_details
|
||||
name: sentinelone-sdl-get-alert-details
|
||||
description: "Get the full details of a single alert, including indicators, observables and related alerts."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
alert_id: { type: string, description: "Alert ID" }
|
||||
required: [alert_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: update_alert
|
||||
name: sentinelone-sdl-update-alert
|
||||
description: "Update an alert: status, analyst verdict and/or assignee."
|
||||
risk: safe_write
|
||||
inputs_schema:
|
||||
properties:
|
||||
alert_id: { type: string, description: "Alert ID" }
|
||||
status: { type: string, description: "New status (NEW, IN_PROGRESS, RESOLVED)" }
|
||||
analyst_verdict: { type: string, description: "Analyst verdict (TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED, ...)" }
|
||||
assignee_user_id: { type: string, description: "User ID to assign (leave empty to skip)" }
|
||||
required: [alert_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: add_note
|
||||
name: sentinelone-sdl-add-note
|
||||
description: "Add an analyst note to an alert."
|
||||
risk: safe_write
|
||||
inputs_schema:
|
||||
properties:
|
||||
alert_id: { type: string, description: "Alert ID" }
|
||||
note_text: { type: string, description: "Note content" }
|
||||
required: [alert_id, note_text]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: trigger_action
|
||||
name: sentinelone-sdl-trigger-action
|
||||
description: "Trigger a mitigation action on an alert (e.g. QUARANTINE, KILL, REMEDIATE)."
|
||||
risk: destructive
|
||||
inputs_schema:
|
||||
properties:
|
||||
alert_id: { type: string, description: "Alert ID" }
|
||||
action_id: { type: string, description: "Action ID to trigger" }
|
||||
action_type: { type: string, description: "Action type (QUARANTINE, UNQUARANTINE, KILL, REMEDIATE, BLOCKLIST_ADD, EXCLUSION_ADD)" }
|
||||
required: [alert_id, action_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Connectivity test ─────────────────────────────────────────────────────
|
||||
- id: test_connection
|
||||
name: sentinelone-sdl-test-connection
|
||||
description: "Verify connectivity and credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
ingestion:
|
||||
command: get_alerts
|
||||
mapper: get_alerts
|
||||
default_incident_type: "SentinelOne SDL Alert"
|
||||
Reference in New Issue
Block a user