From 8fd297169f297b78675f73988568e95470737c85 Mon Sep 17 00:00:00 2001
From: Guillaume BOURGEOIS <guillaume.bourgeois@emeis.com>
Date: Sat, 27 Jun 2026 14:10:37 +0200
Subject: [PATCH] feat(sentinelone): default ingestion (get_threats fetch +
 OCSF mapper)

Declare get_threats as the default fetch command (results_path data, dedup id,
incremental created_after) with the bundled get_threats OCSF mapper and a
'SentinelOne Threat' default incident type. get_alerts is also marked
ingestion-ready (incremental created_from). Existing filters (mitigation
status, query, created window, limit) let an operator fetch a subset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../incident-types/sentinelone-threat.yaml          |  3 +++
 integrations/sentinelone/manifest.yaml              | 13 +++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 integrations/sentinelone/incident-types/sentinelone-threat.yaml

diff --git a/integrations/sentinelone/incident-types/sentinelone-threat.yaml b/integrations/sentinelone/incident-types/sentinelone-threat.yaml
new file mode 100644
index 0000000..fe52f8f
--- /dev/null
+++ b/integrations/sentinelone/incident-types/sentinelone-threat.yaml
@@ -0,0 +1,3 @@
+name: "SentinelOne Threat"
+color: "#a020f0"
+icon: "alert"
diff --git a/integrations/sentinelone/manifest.yaml b/integrations/sentinelone/manifest.yaml
index 936b652..55b9f80 100644
--- a/integrations/sentinelone/manifest.yaml
+++ b/integrations/sentinelone/manifest.yaml
@@ -43,6 +43,10 @@ commands:
         created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
       required: []
     outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: id
+      incremental_field: created_after
 
   - id: list_agents
     name: sentinelone-list-agents
@@ -288,6 +292,10 @@ commands:
         limit: { type: number, description: "Max results (default 100)." }
       required: [created_from]
     outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: id
+      incremental_field: created_from
   - id: update_alerts_verdict
     name: sentinelone-update-alerts-verdict
     description: "Set the analyst verdict on one or more cloud-detection alerts."
@@ -965,3 +973,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_threats
+  mapper: get_threats
+  default_incident_type: "SentinelOne Threat"