feat(sentinelone): instance-level account scope (1.20.0)

An instance can carry the account IDs of the client it serves, for clients
sharing one multi-tenant console. count_agents, get_threats, get_alerts and
get_unified_alerts use them when the block leaves its account filter empty;
an account named on the block still wins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TgjV26rz6VcP262dX4vBrD

integrations/sentinelone/scripts/count_agents.py

@@ -20,6 +20,10 @@ FALSE_WORDS = {"false", "no", "0"}
 def main():
     secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
     inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    # An instance bound to one account of a shared, multi-tenant console carries it
+    # in its config: it scopes the call unless the block names accounts itself.
+    if not str(inputs.get("accountIds") or "").strip() and str(secrets.get("account_ids") or "").strip():
+        inputs["accountIds"] = str(secrets["account_ids"])
     base = secrets.get("url", "").rstrip("/") + "/web/api/v2.1"
     headers = {
         "Authorization": "ApiToken " + secrets.get("api_token", ""),

integrations/sentinelone/scripts/get_alerts.py

@@ -16,6 +16,10 @@ def csv(v):
 def main():
     secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
     inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    # An instance bound to one account of a shared, multi-tenant console carries it
+    # in its config: it scopes the call unless the block names accounts itself.
+    if not str(inputs.get("account_ids") or "").strip() and str(secrets.get("account_ids") or "").strip():
+        inputs["account_ids"] = str(secrets["account_ids"])
     base = secrets.get("url", "").rstrip("/") + "/web/api/v2.1"
     headers = {
         "Authorization": "ApiToken " + secrets.get("api_token", ""),

integrations/sentinelone/scripts/get_threats.py

@@ -12,6 +12,10 @@ def request(method, url, headers, body=None):
 def main():
     secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
     inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    # An instance bound to one account of a shared, multi-tenant console carries it
+    # in its config: it scopes the call unless the block names accounts itself.
+    if not str(inputs.get("account_ids") or "").strip() and str(secrets.get("account_ids") or "").strip():
+        inputs["account_ids"] = str(secrets["account_ids"])
     base = secrets.get("url", "").rstrip("/") + "/web/api/v2.1"
     headers = {
         "Authorization": "ApiToken " + secrets.get("api_token", ""),

integrations/sentinelone/scripts/get_unified_alerts.py

@@ -301,6 +301,10 @@ def sort_clause(form, by):
 def main():
     secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
     inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    # An instance bound to one account of a shared, multi-tenant console carries it
+    # in its config: it scopes the call unless the block names accounts itself.
+    if not str(inputs.get("account_ids") or "").strip() and str(secrets.get("account_ids") or "").strip():
+        inputs["account_ids"] = str(secrets["account_ids"])
     base = secrets.get("url", "").rstrip("/") + "/web/api/v2.1"
     headers = {
         "Authorization": "ApiToken " + secrets.get("api_token", ""),