From df27876a8f02e8e5f28c42438e86ae2ca14e3409 Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Mon, 7 Sep 2026 16:23:04 +0200 Subject: [PATCH] feat(sentinelone): declare a risk tier on every command (v1.9.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An unset risk is treated as destructive by the agent approval gate. Only test_connection carried one, so the other 83 commands — get-threats, get-alerts, count-agents, every lookup in the package — sat behind the same gate as isolate-agent and run-remote-script. A gate that stops everything stops being read as a signal. The package was the marketplace's worst on this: 2 of 86 commands annotated, where all 180 packages declare some and 57 declare them throughout. The next weakest is panos at 2 of 10. 39 read, 22 safe_write, 24 destructive. The line drawn for destructive is impact on the estate, not reversibility — isolate-agent is reversible and is the canonical destructive example: - what removes detection or protection: creating an exclusion, disabling or editing a STAR rule (an edit can silently narrow a rule to match nothing) - what adds blocking: the hash blocklist, a firewall rule - what changes containment in either direction: isolate and reconnect both, since undoing containment mid-incident is its own decision - what reboots or shuts a host down: shutdown, uninstall, enable-agent (it takes an optional reboot), move-agent (it changes the applied policy) - every delete, including removals from the blocklist and the exclusions Authoring detection content in a customer console is a change to that console, so the whole STAR rule lifecycle is gated: create as well as update, disable and delete. Draft status is one click from live and does not earn a lower tier. Additive threat intel stays safe_write: creating an IOC or enabling an existing STAR rule widens what the console sees, which is not the direction that needs a gate. Co-Authored-By: Claude Opus 5 (1M context) --- integrations/sentinelone/manifest.yaml | 87 +++++++++++++++++++++++++- 1 file changed, 85 insertions(+), 2 deletions(-) diff --git a/integrations/sentinelone/manifest.yaml b/integrations/sentinelone/manifest.yaml index 33835cc..312632e 100644 --- a/integrations/sentinelone/manifest.yaml +++ b/integrations/sentinelone/manifest.yaml @@ -1,8 +1,8 @@ id: sentinelone name: SentinelOne -version: 1.8.0 +version: 1.9.0 description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan." -changelog: "1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1." +changelog: "1.9.0 — Every command now declares its risk tier, so the agent approval gate can tell a lookup from an action. Only test_connection and get_unified_alerts did; the other 83 were unset, and an unset risk is treated as destructive, which put get-threats and get-alerts behind the same gate as isolate-agent and run-remote-script. 39 read, 22 safe_write, 24 destructive. Destructive covers what removes detection or protection (exclusions, disabling or editing a STAR rule), what adds blocking (blocklist, firewall rule), what changes containment in either direction (isolate and reconnect both), what reboots or shuts a host down, and every delete. 1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1." category: endpoint # Per-instance configuration. The scripts build the API base as /web/api/v2.1. @@ -34,6 +34,7 @@ commands: - id: get_threats name: sentinelone-get-threats description: List threats/detections matching filters. + risk: read inputs_schema: properties: limit: { type: number, description: "Max results (default 20)" } @@ -52,6 +53,7 @@ commands: - id: list_agents name: sentinelone-list-agents description: List endpoints (agents) matching filters. + risk: read inputs_schema: properties: computer_name: { type: string, description: "Substring match on computer name" } @@ -64,6 +66,7 @@ commands: - id: get_agent name: sentinelone-get-agent description: Get details for one or more agents by ID. + risk: read inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } @@ -73,6 +76,7 @@ commands: - id: get_hash_verdict name: sentinelone-get-hash-verdict description: Reputation verdict for a SHA1 hash. + risk: read inputs_schema: properties: hash: { type: string, description: "SHA1 hash" } @@ -83,6 +87,7 @@ commands: - id: isolate_agent name: sentinelone-isolate-agent description: Disconnect agents from the network. + risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } @@ -92,6 +97,7 @@ commands: - id: reconnect_agent name: sentinelone-reconnect-agent description: Reconnect agents to the network. + risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } @@ -101,6 +107,7 @@ commands: - id: mitigate_threat name: sentinelone-mitigate-threat description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback). + risk: destructive inputs_schema: properties: action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" } @@ -111,6 +118,7 @@ commands: - id: initiate_scan name: sentinelone-initiate-scan description: Start a full disk scan on agents. + risk: safe_write inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } @@ -120,6 +128,7 @@ commands: - id: write_threat_note name: sentinelone-write-threat-note description: Add a note to one or more threats. + risk: safe_write inputs_schema: properties: threat_ids: { type: string, description: "Comma-separated threat IDs" } @@ -131,6 +140,7 @@ commands: - id: shutdown_agent name: sentinelone-shutdown-agent description: "Send a shutdown command to agents matching the filter." + risk: destructive inputs_schema: properties: agent_id: { type: string, description: "Comma-separated agent IDs" } @@ -141,6 +151,7 @@ commands: - id: uninstall_agent name: sentinelone-uninstall-agent description: "Send an uninstall command to agents matching the filter." + risk: destructive inputs_schema: properties: agent_id: { type: string, description: "Comma-separated agent IDs" } @@ -151,6 +162,7 @@ commands: - id: broadcast_message name: sentinelone-broadcast-message description: "Broadcast a message to agents matching the filter." + risk: safe_write inputs_schema: properties: message: { type: string, description: "Message to broadcast to agents" } @@ -162,6 +174,7 @@ commands: - id: enable_agent name: sentinelone-enable-agent description: "Enable agents matching the given IDs, optionally rebooting them." + risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } @@ -171,6 +184,7 @@ commands: - id: move_agent name: sentinelone-move-agent description: "Move agents into the specified group." + risk: destructive inputs_schema: properties: group_id: { type: string, description: "Target group ID" } @@ -180,6 +194,7 @@ commands: - id: count_agents name: sentinelone-count-agents description: "Count agents matching the given filters." + risk: read inputs_schema: properties: computer_name: { type: string, description: "Filter by computer name" } @@ -198,6 +213,7 @@ commands: - id: get_agent_mac name: sentinelone-get-agent-mac description: "Retrieve network interfaces (IP and MAC) for a single agent." + risk: read inputs_schema: properties: agent_id: { type: string, description: "Agent ID" } @@ -206,6 +222,7 @@ commands: - id: get_installed_applications name: sentinelone-get-installed-applications description: "Retrieve the applications installed on the given agents." + risk: read inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } @@ -214,6 +231,7 @@ commands: - id: manage_tags name: sentinelone-manage-tags description: "Add, override or remove a tag on the given agents." + risk: safe_write inputs_schema: properties: tagId: { type: string, description: "Tag ID to apply" } @@ -226,6 +244,7 @@ commands: - id: resolve_threat name: sentinelone-resolve-threat description: "Mark one or more threats as resolved." + risk: safe_write inputs_schema: properties: threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." } @@ -234,6 +253,7 @@ commands: - id: mark_as_threat name: sentinelone-mark-as-threat description: "Mark detections as a true threat, scoped to a site or the whole tenant." + risk: safe_write inputs_schema: properties: threat_ids: { type: string, description: "Comma-separated threat IDs to mark." } @@ -243,6 +263,7 @@ commands: - id: update_threats_verdict name: sentinelone-update-threats-verdict description: "Set the analyst verdict on one or more threats." + risk: safe_write inputs_schema: properties: verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." } @@ -252,6 +273,7 @@ commands: - id: update_threats_status name: sentinelone-update-threats-status description: "Set the incident status on one or more threats." + risk: safe_write inputs_schema: properties: status: { type: string, description: "in_progress, resolved, or unresolved." } @@ -261,6 +283,7 @@ commands: - id: get_threat_notes name: sentinelone-get-threat-notes description: "Retrieve the notes attached to a single threat." + risk: read inputs_schema: properties: threat_id: { type: string, description: "ID of the threat whose notes to retrieve." } @@ -269,6 +292,7 @@ commands: - id: get_threat_summary name: sentinelone-get-threat-summary description: "Retrieve a dashboard threat summary, optionally filtered by site and group." + risk: read inputs_schema: properties: site_ids: { type: string, description: "Comma-separated site IDs." } @@ -278,6 +302,7 @@ commands: - id: fetch_threat_file name: sentinelone-fetch-threat-file description: "Request the threat file for download, protected by a ZIP password." + risk: safe_write inputs_schema: properties: threat_id: { type: string, description: "ID of the threat whose file to fetch." } @@ -287,6 +312,7 @@ commands: - id: get_alerts name: sentinelone-get-alerts description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria." + risk: read inputs_schema: properties: created_from: { type: string, description: "Return alerts created at or after this timestamp." } @@ -307,6 +333,7 @@ commands: - id: update_alerts_verdict name: sentinelone-update-alerts-verdict description: "Set the analyst verdict on one or more cloud-detection alerts." + risk: safe_write inputs_schema: properties: verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." } @@ -316,6 +343,7 @@ commands: - id: update_alerts_status name: sentinelone-update-alerts-status description: "Set the incident status on one or more cloud-detection alerts." + risk: safe_write inputs_schema: properties: status: { type: string, description: "in_progress, resolved, or unresolved." } @@ -327,6 +355,7 @@ commands: - id: get_blocklist name: sentinelone-get-blocklist description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination." + risk: read inputs_schema: properties: global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." } @@ -341,6 +370,7 @@ commands: - id: add_hash_to_blocklist name: sentinelone-add-hash-to-blocklist description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope." + risk: destructive inputs_schema: properties: os_type: { type: string, description: "Target OS type: windows, linux, or macos." } @@ -356,6 +386,7 @@ commands: - id: remove_hash_from_blocklist name: sentinelone-remove-hash-from-blocklist description: "Find blocklist entries matching a SHA1 hash and delete them." + risk: destructive inputs_schema: properties: sha1: { type: string, description: "SHA1 hash to remove." } @@ -365,6 +396,7 @@ commands: - id: get_white_list name: sentinelone-get-white-list description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope." + risk: read inputs_schema: properties: item_ids: { type: string, description: "Comma-separated exclusion item IDs." } @@ -379,6 +411,7 @@ commands: - id: create_white_list_item name: sentinelone-create-white-list-item description: "Create an exclusion (whitelist) item of the given type and value." + risk: destructive inputs_schema: properties: exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." } @@ -394,6 +427,7 @@ commands: - id: remove_item_from_whitelist name: sentinelone-remove-item-from-whitelist description: "Find exclusion items matching a value and delete them." + risk: destructive inputs_schema: properties: item: { type: string, description: "The exclusion value to find and remove." } @@ -404,6 +438,7 @@ commands: - id: delete_exclusion name: sentinelone-delete-exclusion description: "Delete exclusion items by their IDs and type." + risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated exclusion item IDs to delete." } @@ -413,6 +448,7 @@ commands: - id: create_ioc name: sentinelone-create-ioc description: "Create a threat-intelligence IOC for the given account scope." + risk: safe_write inputs_schema: properties: name: { type: string, description: "Name of the IOC." } @@ -429,6 +465,7 @@ commands: - id: delete_ioc name: sentinelone-delete-ioc description: "Delete threat-intelligence IOCs by UUID within the given account scope." + risk: destructive inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } @@ -438,6 +475,7 @@ commands: - id: get_iocs name: sentinelone-get-iocs description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name." + risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } @@ -453,6 +491,7 @@ commands: - id: get_activities name: sentinelone-get-activities description: "Retrieve activities, optionally filtered by date, agents, or threats." + risk: read inputs_schema: properties: created_after: { type: string, description: "Activities created after this timestamp." } @@ -464,6 +503,7 @@ commands: - id: get_groups name: sentinelone-get-groups description: "List groups with optional filters." + risk: read inputs_schema: properties: group_type: { type: string, description: "Group type (static, dynamic)." } @@ -477,6 +517,7 @@ commands: - id: delete_group name: sentinelone-delete-group description: "Delete a group by its ID." + risk: destructive inputs_schema: properties: group_id: { type: string, description: "ID of the group to delete." } @@ -485,6 +526,7 @@ commands: - id: get_sites name: sentinelone-get-sites description: "List sites with optional filters." + risk: read inputs_schema: properties: query: { type: string, description: "Free-text search." } @@ -498,6 +540,7 @@ commands: - id: get_site name: sentinelone-get-site description: "Retrieve a single site by its ID." + risk: read inputs_schema: properties: site_id: { type: string, description: "ID of the site." } @@ -506,6 +549,7 @@ commands: - id: reactivate_site name: sentinelone-reactivate-site description: "Reactivate an expired site." + risk: safe_write inputs_schema: properties: site_id: { type: string, description: "ID of the site to reactivate." } @@ -516,6 +560,7 @@ commands: - id: expire_site name: sentinelone-expire-site description: "Expire a site immediately." + risk: destructive inputs_schema: properties: site_id: { type: string, description: "ID of the site to expire." } @@ -524,6 +569,7 @@ commands: - id: get_accounts name: sentinelone-get-accounts description: "List all accounts, or retrieve a single account when an ID is provided." + risk: read inputs_schema: properties: account_id: { type: string, description: "Optional account ID." } @@ -532,6 +578,7 @@ commands: - id: list_users name: sentinelone-list-users description: "List users, optionally filtered by account IDs." + risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } @@ -541,6 +588,7 @@ commands: - id: delete_user name: sentinelone-delete-user description: "Delete a user by their ID." + risk: destructive inputs_schema: properties: user_id: { type: string, description: "ID of the user to delete." } @@ -549,6 +597,7 @@ commands: - id: create_query name: sentinelone-create-query description: "Initialize a Deep Visibility query over a given time range." + risk: safe_write inputs_schema: properties: query: { type: string, description: "Deep Visibility query string." } @@ -559,6 +608,7 @@ commands: - id: get_dv_query_status name: sentinelone-get-dv-query-status description: "Get the status of a Deep Visibility query by ID." + risk: read inputs_schema: properties: query_id: { type: string, description: "ID of the Deep Visibility query." } @@ -567,6 +617,7 @@ commands: - id: get_events name: sentinelone-get-events description: "Retrieve events for a completed Deep Visibility query." + risk: read inputs_schema: properties: query_id: { type: string, description: "ID of the Deep Visibility query." } @@ -577,6 +628,7 @@ commands: - id: get_processes name: sentinelone-get-processes description: "Retrieve process events for a completed Deep Visibility query." + risk: read inputs_schema: properties: query_id: { type: string, description: "ID of the Deep Visibility query." } @@ -588,6 +640,7 @@ commands: - id: create_star_rule name: sentinelone-create-star-rule description: "Create a STAR custom detection rule in Draft status." + risk: destructive inputs_schema: properties: name: { type: string, description: "Rule name." } @@ -607,6 +660,7 @@ commands: - id: get_star_rules name: sentinelone-get-star-rules description: "List STAR custom detection rules." + risk: read inputs_schema: properties: status: { type: string, description: "Filter by rule status." } @@ -621,6 +675,7 @@ commands: - id: update_star_rule name: sentinelone-update-star-rule description: "Update an existing STAR custom detection rule by ID." + risk: destructive inputs_schema: properties: rule_id: { type: string, description: "ID of the rule to update." } @@ -642,6 +697,7 @@ commands: - id: enable_star_rules name: sentinelone-enable-star-rules description: "Enable one or more STAR custom detection rules by ID." + risk: safe_write inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated rule IDs to enable." } @@ -650,6 +706,7 @@ commands: - id: disable_star_rules name: sentinelone-disable-star-rules description: "Disable one or more STAR custom detection rules by ID." + risk: destructive inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated rule IDs to disable." } @@ -658,6 +715,7 @@ commands: - id: delete_star_rule name: sentinelone-delete-star-rule description: "Delete one or more STAR custom detection rules by ID." + risk: destructive inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated rule IDs to delete." } @@ -666,6 +724,7 @@ commands: - id: run_remote_script name: sentinelone-run-remote-script description: "Execute a remote script (RSO) on the targeted agents." + risk: destructive inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } @@ -682,6 +741,7 @@ commands: - id: create_endpoint_tag name: sentinelone-create-endpoint-tag description: "Create an endpoint tag in the tag manager." + risk: safe_write inputs_schema: properties: type: { type: string, description: "Tag type." } @@ -697,6 +757,7 @@ commands: - id: delete_endpoint_tag name: sentinelone-delete-endpoint-tag description: "Delete endpoint tags matching the given scope filter." + risk: destructive inputs_schema: properties: siteIds: { type: string, description: "Comma-separated site IDs." } @@ -708,6 +769,7 @@ commands: - id: get_endpoint_tags name: sentinelone-get-endpoint-tags description: "List endpoint tags, optionally filtered by key or value substring." + risk: read inputs_schema: properties: key__contains: { type: string, description: "Filter by key substring." } @@ -717,6 +779,7 @@ commands: - id: create_firewall_rule name: sentinelone-create-firewall-rule description: "Create a firewall control rule scoped to an account or site." + risk: destructive inputs_schema: properties: action: { type: string, description: "Allow | Block." } @@ -732,6 +795,7 @@ commands: - id: get_network_discovery_table name: sentinelone-get-network-discovery-table description: "Retrieve the Ranger network discovery table view." + risk: read inputs_schema: properties: hostnames__contains: { type: string, description: "Filter by hostname substring." } @@ -742,6 +806,7 @@ commands: - id: get_network_discovery_assets name: sentinelone-get-network-discovery-assets description: "Retrieve XDR network discovery surface assets." + risk: read inputs_schema: properties: limit: { type: number, description: "Max results (default 50)." } @@ -754,6 +819,7 @@ commands: - id: get_shadow_assets name: sentinelone-get-shadow-assets description: "Retrieve XDR shadow assets with optional coverage filters." + risk: read inputs_schema: properties: limit: { type: number, description: "Max results (default 50)." } @@ -767,6 +833,7 @@ commands: - id: get_gateways name: sentinelone-get-gateways description: "List Ranger gateways." + risk: read inputs_schema: properties: {} required: [] @@ -774,6 +841,7 @@ commands: - id: purge_crash_dumps name: sentinelone-purge-crash-dumps description: "Purge agent crash dumps for the specified agents." + risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs." } @@ -782,6 +850,7 @@ commands: - id: list_endpoints_with_application name: sentinelone-list-endpoints-with-application description: "List the application inventory across endpoints." + risk: read inputs_schema: properties: groupIds: { type: string, description: "Comma-separated group IDs." } @@ -795,6 +864,7 @@ commands: - id: get_app_inventory_endpoints name: sentinelone-get-app-inventory-endpoints description: "List endpoints that have a given application installed." + risk: read inputs_schema: properties: applicationName: { type: string, description: "Application name filter." } @@ -811,6 +881,7 @@ commands: - id: threat_analysis name: sentinelone-threat-analysis description: "Return the detailed analysis for a threat (agent, detection and threat info)." + risk: read inputs_schema: properties: threat_id: { type: string, description: "Threat ID." } @@ -820,6 +891,7 @@ commands: - id: threat_download_from_cloud name: sentinelone-threat-download-from-cloud description: "Get a download URL for a threat's sample from the cloud (BinaryVault)." + risk: read inputs_schema: properties: threat_id: { type: string, description: "Threat ID." } @@ -830,6 +902,7 @@ commands: - id: abort_endpoint_scan name: sentinelone-abort-endpoint-scan description: "Abort the disk scan on the given agents." + risk: safe_write inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs." } @@ -839,6 +912,7 @@ commands: - id: endpoint_fetch_logs name: sentinelone-endpoint-fetch-logs description: "Fetch agent/endpoint logs from the given agents." + risk: safe_write inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs." } @@ -851,6 +925,7 @@ commands: - id: fetch_file name: sentinelone-fetch-file description: "Request a file fetch from an agent endpoint (collected as a password-protected zip)." + risk: safe_write inputs_schema: properties: agent_id: { type: string, description: "Agent ID." } @@ -863,6 +938,7 @@ commands: - id: get_remote_script_task_status name: sentinelone-get-remote-script-task-status description: "Get the status of remote-script tasks for a parent task." + risk: read inputs_schema: properties: parent_task_id: { type: string, description: "Parent task ID." } @@ -878,6 +954,7 @@ commands: - id: get_remote_script_task_results name: sentinelone-get-remote-script-task-results description: "Get download links for the results of remote-script tasks." + risk: read inputs_schema: properties: task_ids: { type: string, description: "Comma-separated task IDs." } @@ -889,6 +966,7 @@ commands: - id: get_service_users name: sentinelone-get-service-users description: "List service users (API token accounts)." + risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } @@ -902,6 +980,7 @@ commands: - id: list_installed_singularity_marketplace_applications name: sentinelone-list-installed-singularity-marketplace-applications description: "List installed Singularity Marketplace applications." + risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } @@ -944,6 +1023,7 @@ commands: - id: update_uam_alert_status name: sentinelone-update-uam-alert-status description: "Update the status of a unified (UAM) alert." + risk: safe_write inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } @@ -954,6 +1034,7 @@ commands: - id: update_uam_alert_verdict name: sentinelone-update-uam-alert-verdict description: "Update the analyst verdict of a unified (UAM) alert." + risk: safe_write inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } @@ -965,6 +1046,7 @@ commands: - id: run_powerquery name: sentinelone-run-powerquery description: "Run a PowerQuery against the Singularity Data Lake (separate XDR URL + Log Read API key)." + risk: read inputs_schema: properties: singularity_xdr_url: { type: string, description: "Singularity Data Lake XDR URL (https://...)." } @@ -982,6 +1064,7 @@ commands: - id: create_tag_rule name: sentinelone-create-tag-rule description: "Create a dynamic asset tag rule (XDR) that tags assets matching a property filter." + risk: safe_write inputs_schema: properties: name: { type: string, description: "Rule name." }