feat(sentinelone): curated EDR integration (9 analyst commands, API v2.1)

Endpoints derived from the SentinelOne API v2.1. Script-based (urllib, INTEGRATION_SECRETS/INPUTS contract) to express S1's nested filter bodies. Config: console url + api_token (ApiToken header). Commands: - enrich: get_threats, list_agents, get_agent, get_hash_verdict - respond: isolate_agent (disconnect), reconnect_agent (connect), mitigate_threat (kill/quarantine/remediate/rollback), initiate_scan, write_threat_note
2026-06-22 12:31:45 +02:00
parent d701284f46
commit a3ac1ee30d
10 changed files with 465 additions and 0 deletions
@@ -0,0 +1,123 @@
+id: sentinelone
+name: SentinelOne
+version: 1.0.0
+description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
+changelog: "1.0.0 — Initial release: threats, agents, hash verdict, isolate/reconnect, mitigate, scan, threat notes."
+category: endpoint
+
+# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
+config_schema:
+  properties:
+    url:
+      type: string
+      description: SentinelOne console URL, e.g. https://usea1.sentinelone.net
+    api_token:
+      type: string
+      description: API token (console → My User → API Token)
+      x-soar-sensitive: true
+  required:
+    - url
+    - api_token
+
+# Documented for reference; the bundled scripts build the header themselves
+# (Authorization: ApiToken <token>).
+auth:
+  - id: apitoken
+    type: api_key
+    in: header
+    name: Authorization
+    value_template: "ApiToken {{secret}}"
+    secret_field: api_token
+
+commands:
+  # ── Enrichment / read ─────────────────────────────────────────────────────
+  - id: get_threats
+    name: Get threats
+    description: List threats/detections matching filters.
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max results (default 20)" }
+        mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" }
+        query: { type: string, description: "Free-text (hash, file, computer name, uuid)" }
+        threat_ids: { type: string, description: "Comma-separated threat IDs" }
+        created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: list_agents
+    name: List agents
+    description: List endpoints (agents) matching filters.
+    inputs_schema:
+      properties:
+        computer_name: { type: string, description: "Substring match on computer name" }
+        os_type: { type: string, description: "windows | macos | linux" }
+        is_active: { type: boolean, description: "Only active agents" }
+        limit: { type: number, description: "Max results (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: get_agent
+    name: Get agent
+    description: Get details for one or more agents by ID.
+    inputs_schema:
+      properties:
+        agent_ids: { type: string, description: "Comma-separated agent IDs" }
+      required: [agent_ids]
+    outputs_schema: { properties: {} }
+
+  - id: get_hash_verdict
+    name: Get hash verdict
+    description: Reputation verdict for a SHA1 hash.
+    inputs_schema:
+      properties:
+        hash: { type: string, description: "SHA1 hash" }
+      required: [hash]
+    outputs_schema: { properties: {} }
+
+  # ── Response ──────────────────────────────────────────────────────────────
+  - id: isolate_agent
+    name: Isolate agent (disconnect)
+    description: Disconnect agents from the network.
+    inputs_schema:
+      properties:
+        agent_ids: { type: string, description: "Comma-separated agent IDs" }
+      required: [agent_ids]
+    outputs_schema: { properties: {} }
+
+  - id: reconnect_agent
+    name: Reconnect agent
+    description: Reconnect agents to the network.
+    inputs_schema:
+      properties:
+        agent_ids: { type: string, description: "Comma-separated agent IDs" }
+      required: [agent_ids]
+    outputs_schema: { properties: {} }
+
+  - id: mitigate_threat
+    name: Mitigate threat
+    description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
+    inputs_schema:
+      properties:
+        action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
+        threat_ids: { type: string, description: "Comma-separated threat IDs" }
+      required: [action, threat_ids]
+    outputs_schema: { properties: {} }
+
+  - id: initiate_scan
+    name: Initiate endpoint scan
+    description: Start a full disk scan on agents.
+    inputs_schema:
+      properties:
+        agent_ids: { type: string, description: "Comma-separated agent IDs" }
+      required: [agent_ids]
+    outputs_schema: { properties: {} }
+
+  - id: write_threat_note
+    name: Add threat note
+    description: Add a note to one or more threats.
+    inputs_schema:
+      properties:
+        threat_ids: { type: string, description: "Comma-separated threat IDs" }
+        note: { type: string, description: "Note text" }
+      required: [threat_ids, note]
+    outputs_schema: { properties: {} }