feat(sentinelone): full command coverage (70 commands, SentinelOne API v2.1)
Expand from 9 to 70 commands covering the official + DEV SentinelOne V2 integrations: agents (actions/info/tags/count), threats & alerts (verdict/status/ notes/mitigate/fetch-file), hash blocklist & exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, endpoint tags, firewall rules and network discovery. All script-based (urllib, INTEGRATION_SECRETS/INPUTS contract); inputs prioritized from the DEV integration.
This commit is contained in:
@@ -2,7 +2,7 @@ id: sentinelone
|
||||
name: SentinelOne
|
||||
version: 1.0.0
|
||||
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
|
||||
changelog: "1.0.0 — Initial release: threats, agents, hash verdict, isolate/reconnect, mitigate, scan, threat notes."
|
||||
changelog: "1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery (parity with the XSOAR SentinelOne V2 integration)."
|
||||
category: endpoint
|
||||
|
||||
# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
|
||||
@@ -121,3 +121,672 @@ commands:
|
||||
note: { type: string, description: "Note text" }
|
||||
required: [threat_ids, note]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Agents: actions & info ────────────────────────────────────────────────
|
||||
- id: shutdown_agent
|
||||
name: Shutdown agent
|
||||
description: "Send a shutdown command to agents matching the filter."
|
||||
inputs_schema:
|
||||
properties:
|
||||
agent_id: { type: string, description: "Comma-separated agent IDs" }
|
||||
group_id: { type: string, description: "Comma-separated group IDs" }
|
||||
query: { type: string, description: "Free-text agent match" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: uninstall_agent
|
||||
name: Uninstall agent
|
||||
description: "Send an uninstall command to agents matching the filter."
|
||||
inputs_schema:
|
||||
properties:
|
||||
agent_id: { type: string, description: "Comma-separated agent IDs" }
|
||||
group_id: { type: string, description: "Comma-separated group IDs" }
|
||||
query: { type: string, description: "Free-text agent match" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: broadcast_message
|
||||
name: Broadcast message
|
||||
description: "Broadcast a message to agents matching the filter."
|
||||
inputs_schema:
|
||||
properties:
|
||||
message: { type: string, description: "Message to broadcast to agents" }
|
||||
agent_id: { type: string, description: "Comma-separated agent IDs" }
|
||||
group_id: { type: string, description: "Comma-separated group IDs" }
|
||||
active_agent: { type: boolean, description: "Only target active agents" }
|
||||
required: [message]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: enable_agent
|
||||
name: Enable agent
|
||||
description: "Enable agents matching the given IDs, optionally rebooting them."
|
||||
inputs_schema:
|
||||
properties:
|
||||
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
||||
shouldReboot: { type: boolean, description: "Reboot agents after enabling" }
|
||||
required: [agent_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: move_agent
|
||||
name: Move agent
|
||||
description: "Move agents into the specified group."
|
||||
inputs_schema:
|
||||
properties:
|
||||
group_id: { type: string, description: "Target group ID" }
|
||||
agents_ids: { type: string, description: "Comma-separated agent IDs to move" }
|
||||
required: [group_id, agents_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: count_agents
|
||||
name: Count agents
|
||||
description: "Count agents matching the given filters."
|
||||
inputs_schema:
|
||||
properties:
|
||||
computer_name: { type: string, description: "Filter by computer name" }
|
||||
os_type: { type: string, description: "Filter by OS type" }
|
||||
scan_status: { type: string, description: "Filter by scan status" }
|
||||
siteIds: { type: string, description: "Comma-separated site IDs" }
|
||||
groupIds: { type: string, description: "Comma-separated group IDs" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_agent_mac
|
||||
name: Get agent MAC addresses
|
||||
description: "Retrieve network interfaces (IP and MAC) for a single agent."
|
||||
inputs_schema:
|
||||
properties:
|
||||
agent_id: { type: string, description: "Agent ID" }
|
||||
required: [agent_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_installed_applications
|
||||
name: Get installed applications
|
||||
description: "Retrieve the applications installed on the given agents."
|
||||
inputs_schema:
|
||||
properties:
|
||||
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
||||
required: [agent_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: manage_tags
|
||||
name: Manage tags
|
||||
description: "Add, override or remove a tag on the given agents."
|
||||
inputs_schema:
|
||||
properties:
|
||||
tagId: { type: string, description: "Tag ID to apply" }
|
||||
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
||||
operation: { type: string, description: "Tag operation: add, override or remove" }
|
||||
required: [tagId, agent_ids, operation]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Threats & Alerts ──────────────────────────────────────────────────────
|
||||
- id: resolve_threat
|
||||
name: Resolve threat
|
||||
description: "Mark one or more threats as resolved."
|
||||
inputs_schema:
|
||||
properties:
|
||||
threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." }
|
||||
required: [threat_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: mark_as_threat
|
||||
name: Mark as threat
|
||||
description: "Mark detections as a true threat, scoped to a site or the whole tenant."
|
||||
inputs_schema:
|
||||
properties:
|
||||
threat_ids: { type: string, description: "Comma-separated threat IDs to mark." }
|
||||
target_scope: { type: string, description: "Scope of the action: site or tenant." }
|
||||
required: [threat_ids, target_scope]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_threats_verdict
|
||||
name: Update threats verdict
|
||||
description: "Set the analyst verdict on one or more threats."
|
||||
inputs_schema:
|
||||
properties:
|
||||
verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
|
||||
threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
|
||||
required: [verdict, threat_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_threats_status
|
||||
name: Update threats status
|
||||
description: "Set the incident status on one or more threats."
|
||||
inputs_schema:
|
||||
properties:
|
||||
status: { type: string, description: "in_progress, resolved, or unresolved." }
|
||||
threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
|
||||
required: [status, threat_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_threat_notes
|
||||
name: Get threat notes
|
||||
description: "Retrieve the notes attached to a single threat."
|
||||
inputs_schema:
|
||||
properties:
|
||||
threat_id: { type: string, description: "ID of the threat whose notes to retrieve." }
|
||||
required: [threat_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_threat_summary
|
||||
name: Get threat summary
|
||||
description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
|
||||
inputs_schema:
|
||||
properties:
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: fetch_threat_file
|
||||
name: Fetch threat file
|
||||
description: "Request the threat file for download, protected by a ZIP password."
|
||||
inputs_schema:
|
||||
properties:
|
||||
threat_id: { type: string, description: "ID of the threat whose file to fetch." }
|
||||
password: { type: string, description: "Password used to encrypt the fetched file ZIP." }
|
||||
required: [threat_id, password]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_alerts
|
||||
name: Get alerts
|
||||
description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
|
||||
inputs_schema:
|
||||
properties:
|
||||
created_from: { type: string, description: "Return alerts created at or after this timestamp." }
|
||||
created_until: { type: string, description: "Return alerts created at or before this timestamp." }
|
||||
ruleName: { type: string, description: "Filter by rule name substring." }
|
||||
incidentStatus: { type: string, description: "Filter by incident status." }
|
||||
analystVerdict: { type: string, description: "Filter by analyst verdict." }
|
||||
alert_ids: { type: string, description: "Comma-separated alert IDs." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
limit: { type: number, description: "Max results (default 100)." }
|
||||
required: [created_from]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_alerts_verdict
|
||||
name: Update alerts verdict
|
||||
description: "Set the analyst verdict on one or more cloud-detection alerts."
|
||||
inputs_schema:
|
||||
properties:
|
||||
verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
|
||||
alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
|
||||
required: [verdict, alert_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_alerts_status
|
||||
name: Update alerts status
|
||||
description: "Set the incident status on one or more cloud-detection alerts."
|
||||
inputs_schema:
|
||||
properties:
|
||||
status: { type: string, description: "in_progress, resolved, or unresolved." }
|
||||
alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
|
||||
required: [status, alert_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Hash, blocklist, exclusions, IOCs ─────────────────────────────────────
|
||||
- id: get_blocklist
|
||||
name: Get blocklist
|
||||
description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
|
||||
inputs_schema:
|
||||
properties:
|
||||
global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." }
|
||||
hash: { type: string, description: "Filter by hash value substring." }
|
||||
offset: { type: number, description: "Records to skip for pagination." }
|
||||
limit: { type: number, description: "Max records to return (default 100)." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: add_hash_to_blocklist
|
||||
name: Add hash to blocklist
|
||||
description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
|
||||
inputs_schema:
|
||||
properties:
|
||||
os_type: { type: string, description: "Target OS type: windows, linux, or macos." }
|
||||
sha1: { type: string, description: "SHA1 hash (used if sha256 not provided)." }
|
||||
sha256: { type: string, description: "SHA256 hash (takes precedence over sha1)." }
|
||||
description: { type: string, description: "Optional description." }
|
||||
source: { type: string, description: "Source label (defaults to Riposte)." }
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
required: [os_type]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: remove_hash_from_blocklist
|
||||
name: Remove hash from blocklist
|
||||
description: "Find blocklist entries matching a SHA1 hash and delete them."
|
||||
inputs_schema:
|
||||
properties:
|
||||
sha1: { type: string, description: "SHA1 hash to remove." }
|
||||
os_type: { type: string, description: "Optional OS type filter." }
|
||||
required: [sha1]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_white_list
|
||||
name: Get exclusions (white list)
|
||||
description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
|
||||
inputs_schema:
|
||||
properties:
|
||||
item_ids: { type: string, description: "Comma-separated exclusion item IDs." }
|
||||
os_types: { type: string, description: "Filter by OS types." }
|
||||
exclusion_type: { type: string, description: "Filter by exclusion type." }
|
||||
limit: { type: number, description: "Max records (default 10)." }
|
||||
include_parent: { type: boolean, description: "Include parent-scope exclusions." }
|
||||
include_children: { type: boolean, description: "Include child-scope exclusions." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_white_list_item
|
||||
name: Create exclusion item
|
||||
description: "Create an exclusion (whitelist) item of the given type and value."
|
||||
inputs_schema:
|
||||
properties:
|
||||
exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." }
|
||||
exclusion_value: { type: string, description: "The value to exclude." }
|
||||
os_type: { type: string, description: "Target OS type." }
|
||||
description: { type: string, description: "Optional description." }
|
||||
exclusion_mode: { type: string, description: "Optional exclusion mode." }
|
||||
path_exclusion_type: { type: string, description: "Optional path exclusion type." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
required: [exclusion_type, exclusion_value, os_type]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: remove_item_from_whitelist
|
||||
name: Remove exclusion item
|
||||
description: "Find exclusion items matching a value and delete them."
|
||||
inputs_schema:
|
||||
properties:
|
||||
item: { type: string, description: "The exclusion value to find and remove." }
|
||||
os_type: { type: string, description: "Optional OS type filter." }
|
||||
exclusion_type: { type: string, description: "Optional exclusion type filter." }
|
||||
required: [item]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_exclusion
|
||||
name: Delete exclusion
|
||||
description: "Delete exclusion items by their IDs and type."
|
||||
inputs_schema:
|
||||
properties:
|
||||
ids: { type: string, description: "Comma-separated exclusion item IDs to delete." }
|
||||
type: { type: string, description: "Exclusion type of the items being deleted." }
|
||||
required: [ids, type]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_ioc
|
||||
name: Create IOC
|
||||
description: "Create a threat-intelligence IOC for the given account scope."
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Name of the IOC." }
|
||||
source: { type: string, description: "Source of the IOC." }
|
||||
type: { type: string, description: "IOC type: DNS, IPV4, IPV6, MD5, SHA1, SHA256, or URL." }
|
||||
method: { type: string, description: "Comparison method (e.g. EQUALS)." }
|
||||
validUntil: { type: string, description: "Expiration timestamp (ISO 8601)." }
|
||||
value: { type: string, description: "The IOC value." }
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
externalId: { type: string, description: "Optional external identifier." }
|
||||
description: { type: string, description: "Optional description." }
|
||||
required: [name, source, type, method, validUntil, value, account_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_ioc
|
||||
name: Delete IOC
|
||||
description: "Delete threat-intelligence IOCs by UUID within the given account scope."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
uuids: { type: string, description: "Comma-separated IOC UUIDs to delete." }
|
||||
required: [account_ids, uuids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_iocs
|
||||
name: Get IOCs
|
||||
description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
limit: { type: number, description: "Max records (default 1000)." }
|
||||
type: { type: string, description: "Filter by IOC type." }
|
||||
value: { type: string, description: "Filter by IOC value." }
|
||||
source: { type: string, description: "Filter by IOC source." }
|
||||
name_contains: { type: string, description: "Filter by IOC name substring." }
|
||||
required: [account_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Sites, groups, accounts, users, Deep Visibility ───────────────────────
|
||||
- id: get_activities
|
||||
name: Get activities
|
||||
description: "Retrieve activities, optionally filtered by date, agents, or threats."
|
||||
inputs_schema:
|
||||
properties:
|
||||
created_after: { type: string, description: "Activities created after this timestamp." }
|
||||
limit: { type: number, description: "Max results (default 50)." }
|
||||
agent_ids: { type: string, description: "Comma-separated agent IDs." }
|
||||
threats_ids: { type: string, description: "Comma-separated threat IDs." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_groups
|
||||
name: Get groups
|
||||
description: "List groups with optional filters."
|
||||
inputs_schema:
|
||||
properties:
|
||||
group_type: { type: string, description: "Group type (static, dynamic)." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
is_default: { type: boolean, description: "Filter for default groups only." }
|
||||
name: { type: string, description: "Exact group name." }
|
||||
query: { type: string, description: "Free-text search." }
|
||||
limit: { type: number, description: "Max results (default 50)." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_group
|
||||
name: Delete group
|
||||
description: "Delete a group by its ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
group_id: { type: string, description: "ID of the group to delete." }
|
||||
required: [group_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_sites
|
||||
name: Get sites
|
||||
description: "List sites with optional filters."
|
||||
inputs_schema:
|
||||
properties:
|
||||
query: { type: string, description: "Free-text search." }
|
||||
state: { type: string, description: "Site state (active, expired)." }
|
||||
site_type: { type: string, description: "Site type." }
|
||||
site_name: { type: string, description: "Exact site name." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
limit: { type: number, description: "Max results (default 50)." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_site
|
||||
name: Get site
|
||||
description: "Retrieve a single site by its ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
site_id: { type: string, description: "ID of the site." }
|
||||
required: [site_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: reactivate_site
|
||||
name: Reactivate site
|
||||
description: "Reactivate an expired site."
|
||||
inputs_schema:
|
||||
properties:
|
||||
site_id: { type: string, description: "ID of the site to reactivate." }
|
||||
unlimited: { type: boolean, description: "Set the site to unlimited duration." }
|
||||
expiration: { type: string, description: "New expiration date (ISO 8601)." }
|
||||
required: [site_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: expire_site
|
||||
name: Expire site
|
||||
description: "Expire a site immediately."
|
||||
inputs_schema:
|
||||
properties:
|
||||
site_id: { type: string, description: "ID of the site to expire." }
|
||||
required: [site_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_accounts
|
||||
name: Get accounts
|
||||
description: "List all accounts, or retrieve a single account when an ID is provided."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Optional account ID." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_users
|
||||
name: List users
|
||||
description: "List users, optionally filtered by account IDs."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
limit: { type: number, description: "Max results (default 100)." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_user
|
||||
name: Delete user
|
||||
description: "Delete a user by their ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
user_id: { type: string, description: "ID of the user to delete." }
|
||||
required: [user_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_query
|
||||
name: Create DV query
|
||||
description: "Initialize a Deep Visibility query over a given time range."
|
||||
inputs_schema:
|
||||
properties:
|
||||
query: { type: string, description: "Deep Visibility query string." }
|
||||
from_date: { type: string, description: "Start of the time range (ISO 8601)." }
|
||||
to_date: { type: string, description: "End of the time range (ISO 8601)." }
|
||||
required: [query, from_date, to_date]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_dv_query_status
|
||||
name: Get DV query status
|
||||
description: "Get the status of a Deep Visibility query by ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
query_id: { type: string, description: "ID of the Deep Visibility query." }
|
||||
required: [query_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_events
|
||||
name: Get DV events
|
||||
description: "Retrieve events for a completed Deep Visibility query."
|
||||
inputs_schema:
|
||||
properties:
|
||||
query_id: { type: string, description: "ID of the Deep Visibility query." }
|
||||
limit: { type: number, description: "Max events (default 50)." }
|
||||
cursor: { type: string, description: "Pagination cursor." }
|
||||
required: [query_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_processes
|
||||
name: Get DV processes
|
||||
description: "Retrieve process events for a completed Deep Visibility query."
|
||||
inputs_schema:
|
||||
properties:
|
||||
query_id: { type: string, description: "ID of the Deep Visibility query." }
|
||||
limit: { type: number, description: "Max process events (default 50)." }
|
||||
required: [query_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ──────
|
||||
- id: create_star_rule
|
||||
name: Create STAR rule
|
||||
description: "Create a STAR custom detection rule in Draft status."
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Rule name." }
|
||||
query: { type: string, description: "S1QL detection query." }
|
||||
rule_severity: { type: string, description: "Low | Medium | High | Critical." }
|
||||
expiration_mode: { type: string, description: "Permanent | Temporary." }
|
||||
query_type: { type: string, description: "Query type (defaults to events)." }
|
||||
network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
|
||||
treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
|
||||
description: { type: string, description: "Rule description." }
|
||||
expiration_date: { type: string, description: "Expiration date (when Temporary)." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_star_rules
|
||||
name: Get STAR rules
|
||||
description: "List STAR custom detection rules."
|
||||
inputs_schema:
|
||||
properties:
|
||||
status: { type: string, description: "Filter by rule status." }
|
||||
queryType: { type: string, description: "Filter by query type." }
|
||||
name_contains: { type: string, description: "Filter by name substring." }
|
||||
ruleIds: { type: string, description: "Comma-separated rule IDs." }
|
||||
accountIds: { type: string, description: "Comma-separated account IDs." }
|
||||
siteIds: { type: string, description: "Comma-separated site IDs." }
|
||||
limit: { type: number, description: "Max results (default 1000)." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: update_star_rule
|
||||
name: Update STAR rule
|
||||
description: "Update an existing STAR custom detection rule by ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
rule_id: { type: string, description: "ID of the rule to update." }
|
||||
name: { type: string, description: "Rule name." }
|
||||
query: { type: string, description: "S1QL detection query." }
|
||||
rule_severity: { type: string, description: "Low | Medium | High | Critical." }
|
||||
expiration_mode: { type: string, description: "Permanent | Temporary." }
|
||||
query_type: { type: string, description: "Query type (defaults to events)." }
|
||||
network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
|
||||
treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
|
||||
description: { type: string, description: "Rule description." }
|
||||
expiration_date: { type: string, description: "Expiration date (when Temporary)." }
|
||||
query_lang: { type: string, description: "Query language version." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
group_ids: { type: string, description: "Comma-separated group IDs." }
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: enable_star_rules
|
||||
name: Enable STAR rules
|
||||
description: "Enable one or more STAR custom detection rules by ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
rule_ids: { type: string, description: "Comma-separated rule IDs to enable." }
|
||||
required: [rule_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: disable_star_rules
|
||||
name: Disable STAR rules
|
||||
description: "Disable one or more STAR custom detection rules by ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
rule_ids: { type: string, description: "Comma-separated rule IDs to disable." }
|
||||
required: [rule_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_star_rule
|
||||
name: Delete STAR rule
|
||||
description: "Delete one or more STAR custom detection rules by ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
rule_ids: { type: string, description: "Comma-separated rule IDs to delete." }
|
||||
required: [rule_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: run_remote_script
|
||||
name: Run remote script
|
||||
description: "Execute a remote script (RSO) on the targeted agents."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_ids: { type: string, description: "Comma-separated account IDs." }
|
||||
script_id: { type: string, description: "ID of the remote script to run." }
|
||||
output_destination: { type: string, description: "Where script output is sent." }
|
||||
task_description: { type: string, description: "Description of the task." }
|
||||
agent_ids: { type: string, description: "Comma-separated agent IDs to target." }
|
||||
site_ids: { type: string, description: "Comma-separated site IDs." }
|
||||
input_params: { type: string, description: "Input parameters passed to the script." }
|
||||
password: { type: string, description: "Password for protected scripts." }
|
||||
requires_approval: { type: boolean, description: "Whether execution requires approval." }
|
||||
required: [account_ids, script_id, output_destination, task_description]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_endpoint_tag
|
||||
name: Create endpoint tag
|
||||
description: "Create an endpoint tag in the tag manager."
|
||||
inputs_schema:
|
||||
properties:
|
||||
type: { type: string, description: "Tag type." }
|
||||
key: { type: string, description: "Tag key." }
|
||||
value: { type: string, description: "Tag value." }
|
||||
description: { type: string, description: "Tag description." }
|
||||
groupIds: { type: string, description: "Comma-separated group IDs." }
|
||||
siteIds: { type: string, description: "Comma-separated site IDs." }
|
||||
accountIds: { type: string, description: "Comma-separated account IDs." }
|
||||
tenant: { type: boolean, description: "Apply at tenant scope." }
|
||||
required: [type, key]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_endpoint_tag
|
||||
name: Delete endpoint tag
|
||||
description: "Delete endpoint tags matching the given scope filter."
|
||||
inputs_schema:
|
||||
properties:
|
||||
siteIds: { type: string, description: "Comma-separated site IDs." }
|
||||
groupIds: { type: string, description: "Comma-separated group IDs." }
|
||||
accountIds: { type: string, description: "Comma-separated account IDs." }
|
||||
query: { type: string, description: "Free-text query filter." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_endpoint_tags
|
||||
name: Get endpoint tags
|
||||
description: "List endpoint tags, optionally filtered by key or value substring."
|
||||
inputs_schema:
|
||||
properties:
|
||||
key__contains: { type: string, description: "Filter by key substring." }
|
||||
value__contains: { type: string, description: "Filter by value substring." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_firewall_rule
|
||||
name: Create firewall rule
|
||||
description: "Create a firewall control rule scoped to an account or site."
|
||||
inputs_schema:
|
||||
properties:
|
||||
action: { type: string, description: "Allow | Block." }
|
||||
name: { type: string, description: "Rule name." }
|
||||
status: { type: string, description: "Enabled | Disabled." }
|
||||
description: { type: string, description: "Rule description." }
|
||||
direction: { type: string, description: "incoming | outgoing | any." }
|
||||
filter_type: { type: string, description: "Scope filter type: accountIds | siteIds." }
|
||||
filter_id: { type: string, description: "ID for the chosen scope filter type." }
|
||||
remote_host: { type: string, description: "Comma-separated remote host addresses." }
|
||||
required: [action, name, status, description, direction, filter_type, filter_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_network_discovery_table
|
||||
name: Get network discovery table
|
||||
description: "Retrieve the Ranger network discovery table view."
|
||||
inputs_schema:
|
||||
properties:
|
||||
hostnames__contains: { type: string, description: "Filter by hostname substring." }
|
||||
externalIp: { type: string, description: "Filter by exact external IP." }
|
||||
externalIp__contains: { type: string, description: "Filter by external IP substring." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_network_discovery_assets
|
||||
name: Get network discovery assets
|
||||
description: "Retrieve XDR network discovery surface assets."
|
||||
inputs_schema:
|
||||
properties:
|
||||
limit: { type: number, description: "Max results (default 50)." }
|
||||
account_id: { type: string, description: "Account ID filter." }
|
||||
site_id: { type: string, description: "Site ID filter." }
|
||||
hostname: { type: string, description: "Filter by name substring." }
|
||||
epp_status: { type: string, description: "Filter by EPP unsupported/unknown status." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_shadow_assets
|
||||
name: Get shadow assets
|
||||
description: "Retrieve XDR shadow assets with optional coverage filters."
|
||||
inputs_schema:
|
||||
properties:
|
||||
limit: { type: number, description: "Max results (default 50)." }
|
||||
account_id: { type: string, description: "Account ID filter." }
|
||||
site_id: { type: string, description: "Site ID filter." }
|
||||
name: { type: string, description: "Filter by name substring." }
|
||||
active_coverage: { type: string, description: "Filter by active coverage." }
|
||||
missing_coverage: { type: string, description: "Filter by missing coverage." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_gateways
|
||||
name: Get gateways
|
||||
description: "List Ranger gateways."
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: purge_crash_dumps
|
||||
name: Purge crash dumps
|
||||
description: "Purge agent crash dumps for the specified agents."
|
||||
inputs_schema:
|
||||
properties:
|
||||
agent_ids: { type: string, description: "Comma-separated agent IDs." }
|
||||
required: [agent_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_endpoints_with_application
|
||||
name: List endpoints with application
|
||||
description: "List the application inventory across endpoints."
|
||||
inputs_schema:
|
||||
properties:
|
||||
groupIds: { type: string, description: "Comma-separated group IDs." }
|
||||
name__contains: { type: string, description: "Filter by application name substring." }
|
||||
osTypes: { type: string, description: "Filter by OS types." }
|
||||
vendor__contains: { type: string, description: "Filter by vendor substring." }
|
||||
siteIds: { type: string, description: "Comma-separated site IDs." }
|
||||
limit: { type: number, description: "Max results (default 10)." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_app_inventory_endpoints
|
||||
name: Get app inventory endpoints
|
||||
description: "List endpoints that have a given application installed."
|
||||
inputs_schema:
|
||||
properties:
|
||||
applicationName: { type: string, description: "Application name filter." }
|
||||
applicationVendor: { type: string, description: "Application vendor filter." }
|
||||
siteIds: { type: string, description: "Comma-separated site IDs." }
|
||||
groupIds: { type: string, description: "Comma-separated group IDs." }
|
||||
accountIds: { type: string, description: "Comma-separated account IDs." }
|
||||
cursor: { type: string, description: "Pagination cursor." }
|
||||
limit: { type: number, description: "Max results (default 50)." }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
Reference in New Issue
Block a user