f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sentinelone): declare a risk tier on every command (v1.9.0)

Browse Source 
An unset risk is treated as destructive by the agent approval gate. Only
test_connection carried one, so the other 83 commands — get-threats,
get-alerts, count-agents, every lookup in the package — sat behind the same
gate as isolate-agent and run-remote-script. A gate that stops everything
stops being read as a signal.

The package was the marketplace's worst on this: 2 of 86 commands annotated,
where all 180 packages declare some and 57 declare them throughout. The next
weakest is panos at 2 of 10.

39 read, 22 safe_write, 24 destructive. The line drawn for destructive is
impact on the estate, not reversibility — isolate-agent is reversible and is
the canonical destructive example:

- what removes detection or protection: creating an exclusion, disabling or
  editing a STAR rule (an edit can silently narrow a rule to match nothing)
- what adds blocking: the hash blocklist, a firewall rule
- what changes containment in either direction: isolate and reconnect both,
  since undoing containment mid-incident is its own decision
- what reboots or shuts a host down: shutdown, uninstall, enable-agent (it
  takes an optional reboot), move-agent (it changes the applied policy)
- every delete, including removals from the blocklist and the exclusions

Authoring detection content in a customer console is a change to that
console, so the whole STAR rule lifecycle is gated: create as well as update,
disable and delete. Draft status is one click from live and does not earn a
lower tier.

Additive threat intel stays safe_write: creating an IOC or enabling an
existing STAR rule widens what the console sees, which is not the direction
that needs a gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-09-07 16:23:04 +02:00
parent fd4b1b18f7
commit df27876a8f
1 changed files with 85 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/sentinelone/manifest.yaml
+85 -2
View File
@@ -1,8 +1,8 @@
id: sentinelone id: sentinelone
name: SentinelOne name: SentinelOne
version: 1.8.0 version: 1.9.0
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan." description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
changelog: "1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1." changelog: "1.9.0 — Every command now declares its risk tier, so the agent approval gate can tell a lookup from an action. Only test_connection and get_unified_alerts did; the other 83 were unset, and an unset risk is treated as destructive, which put get-threats and get-alerts behind the same gate as isolate-agent and run-remote-script. 39 read, 22 safe_write, 24 destructive. Destructive covers what removes detection or protection (exclusions, disabling or editing a STAR rule), what adds blocking (blocklist, firewall rule), what changes containment in either direction (isolate and reconnect both), what reboots or shuts a host down, and every delete. 1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
category: endpoint category: endpoint
# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1. # Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
@@ -34,6 +34,7 @@ commands:
- id: get_threats - id: get_threats
name: sentinelone-get-threats name: sentinelone-get-threats
description: List threats/detections matching filters. description: List threats/detections matching filters.
risk: read
inputs_schema: inputs_schema:
properties: properties:
limit: { type: number, description: "Max results (default 20)" } limit: { type: number, description: "Max results (default 20)" }
@@ -52,6 +53,7 @@ commands:
- id: list_agents - id: list_agents
name: sentinelone-list-agents name: sentinelone-list-agents
description: List endpoints (agents) matching filters. description: List endpoints (agents) matching filters.
risk: read
inputs_schema: inputs_schema:
properties: properties:
computer_name: { type: string, description: "Substring match on computer name" } computer_name: { type: string, description: "Substring match on computer name" }
@@ -64,6 +66,7 @@ commands:
- id: get_agent - id: get_agent
name: sentinelone-get-agent name: sentinelone-get-agent
description: Get details for one or more agents by ID. description: Get details for one or more agents by ID.
risk: read
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs" } agent_ids: { type: string, description: "Comma-separated agent IDs" }
@@ -73,6 +76,7 @@ commands:
- id: get_hash_verdict - id: get_hash_verdict
name: sentinelone-get-hash-verdict name: sentinelone-get-hash-verdict
description: Reputation verdict for a SHA1 hash. description: Reputation verdict for a SHA1 hash.
risk: read
inputs_schema: inputs_schema:
properties: properties:
hash: { type: string, description: "SHA1 hash" } hash: { type: string, description: "SHA1 hash" }
@@ -83,6 +87,7 @@ commands:
- id: isolate_agent - id: isolate_agent
name: sentinelone-isolate-agent name: sentinelone-isolate-agent
description: Disconnect agents from the network. description: Disconnect agents from the network.
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs" } agent_ids: { type: string, description: "Comma-separated agent IDs" }
@@ -92,6 +97,7 @@ commands:
- id: reconnect_agent - id: reconnect_agent
name: sentinelone-reconnect-agent name: sentinelone-reconnect-agent
description: Reconnect agents to the network. description: Reconnect agents to the network.
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs" } agent_ids: { type: string, description: "Comma-separated agent IDs" }
@@ -101,6 +107,7 @@ commands:
- id: mitigate_threat - id: mitigate_threat
name: sentinelone-mitigate-threat name: sentinelone-mitigate-threat
description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback). description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" } action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
@@ -111,6 +118,7 @@ commands:
- id: initiate_scan - id: initiate_scan
name: sentinelone-initiate-scan name: sentinelone-initiate-scan
description: Start a full disk scan on agents. description: Start a full disk scan on agents.
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs" } agent_ids: { type: string, description: "Comma-separated agent IDs" }
@@ -120,6 +128,7 @@ commands:
- id: write_threat_note - id: write_threat_note
name: sentinelone-write-threat-note name: sentinelone-write-threat-note
description: Add a note to one or more threats. description: Add a note to one or more threats.
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
threat_ids: { type: string, description: "Comma-separated threat IDs" } threat_ids: { type: string, description: "Comma-separated threat IDs" }
@@ -131,6 +140,7 @@ commands:
- id: shutdown_agent - id: shutdown_agent
name: sentinelone-shutdown-agent name: sentinelone-shutdown-agent
description: "Send a shutdown command to agents matching the filter." description: "Send a shutdown command to agents matching the filter."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
agent_id: { type: string, description: "Comma-separated agent IDs" } agent_id: { type: string, description: "Comma-separated agent IDs" }
@@ -141,6 +151,7 @@ commands:
- id: uninstall_agent - id: uninstall_agent
name: sentinelone-uninstall-agent name: sentinelone-uninstall-agent
description: "Send an uninstall command to agents matching the filter." description: "Send an uninstall command to agents matching the filter."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
agent_id: { type: string, description: "Comma-separated agent IDs" } agent_id: { type: string, description: "Comma-separated agent IDs" }
@@ -151,6 +162,7 @@ commands:
- id: broadcast_message - id: broadcast_message
name: sentinelone-broadcast-message name: sentinelone-broadcast-message
description: "Broadcast a message to agents matching the filter." description: "Broadcast a message to agents matching the filter."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
message: { type: string, description: "Message to broadcast to agents" } message: { type: string, description: "Message to broadcast to agents" }
@@ -162,6 +174,7 @@ commands:
- id: enable_agent - id: enable_agent
name: sentinelone-enable-agent name: sentinelone-enable-agent
description: "Enable agents matching the given IDs, optionally rebooting them." description: "Enable agents matching the given IDs, optionally rebooting them."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs" } agent_ids: { type: string, description: "Comma-separated agent IDs" }
@@ -171,6 +184,7 @@ commands:
- id: move_agent - id: move_agent
name: sentinelone-move-agent name: sentinelone-move-agent
description: "Move agents into the specified group." description: "Move agents into the specified group."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
group_id: { type: string, description: "Target group ID" } group_id: { type: string, description: "Target group ID" }
@@ -180,6 +194,7 @@ commands:
- id: count_agents - id: count_agents
name: sentinelone-count-agents name: sentinelone-count-agents
description: "Count agents matching the given filters." description: "Count agents matching the given filters."
risk: read
inputs_schema: inputs_schema:
properties: properties:
computer_name: { type: string, description: "Filter by computer name" } computer_name: { type: string, description: "Filter by computer name" }
@@ -198,6 +213,7 @@ commands:
- id: get_agent_mac - id: get_agent_mac
name: sentinelone-get-agent-mac name: sentinelone-get-agent-mac
description: "Retrieve network interfaces (IP and MAC) for a single agent." description: "Retrieve network interfaces (IP and MAC) for a single agent."
risk: read
inputs_schema: inputs_schema:
properties: properties:
agent_id: { type: string, description: "Agent ID" } agent_id: { type: string, description: "Agent ID" }
@@ -206,6 +222,7 @@ commands:
- id: get_installed_applications - id: get_installed_applications
name: sentinelone-get-installed-applications name: sentinelone-get-installed-applications
description: "Retrieve the applications installed on the given agents." description: "Retrieve the applications installed on the given agents."
risk: read
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs" } agent_ids: { type: string, description: "Comma-separated agent IDs" }
@@ -214,6 +231,7 @@ commands:
- id: manage_tags - id: manage_tags
name: sentinelone-manage-tags name: sentinelone-manage-tags
description: "Add, override or remove a tag on the given agents." description: "Add, override or remove a tag on the given agents."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
tagId: { type: string, description: "Tag ID to apply" } tagId: { type: string, description: "Tag ID to apply" }
@@ -226,6 +244,7 @@ commands:
- id: resolve_threat - id: resolve_threat
name: sentinelone-resolve-threat name: sentinelone-resolve-threat
description: "Mark one or more threats as resolved." description: "Mark one or more threats as resolved."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." } threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." }
@@ -234,6 +253,7 @@ commands:
- id: mark_as_threat - id: mark_as_threat
name: sentinelone-mark-as-threat name: sentinelone-mark-as-threat
description: "Mark detections as a true threat, scoped to a site or the whole tenant." description: "Mark detections as a true threat, scoped to a site or the whole tenant."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
threat_ids: { type: string, description: "Comma-separated threat IDs to mark." } threat_ids: { type: string, description: "Comma-separated threat IDs to mark." }
@@ -243,6 +263,7 @@ commands:
- id: update_threats_verdict - id: update_threats_verdict
name: sentinelone-update-threats-verdict name: sentinelone-update-threats-verdict
description: "Set the analyst verdict on one or more threats." description: "Set the analyst verdict on one or more threats."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." } verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
@@ -252,6 +273,7 @@ commands:
- id: update_threats_status - id: update_threats_status
name: sentinelone-update-threats-status name: sentinelone-update-threats-status
description: "Set the incident status on one or more threats." description: "Set the incident status on one or more threats."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
status: { type: string, description: "in_progress, resolved, or unresolved." } status: { type: string, description: "in_progress, resolved, or unresolved." }
@@ -261,6 +283,7 @@ commands:
- id: get_threat_notes - id: get_threat_notes
name: sentinelone-get-threat-notes name: sentinelone-get-threat-notes
description: "Retrieve the notes attached to a single threat." description: "Retrieve the notes attached to a single threat."
risk: read
inputs_schema: inputs_schema:
properties: properties:
threat_id: { type: string, description: "ID of the threat whose notes to retrieve." } threat_id: { type: string, description: "ID of the threat whose notes to retrieve." }
@@ -269,6 +292,7 @@ commands:
- id: get_threat_summary - id: get_threat_summary
name: sentinelone-get-threat-summary name: sentinelone-get-threat-summary
description: "Retrieve a dashboard threat summary, optionally filtered by site and group." description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
risk: read
inputs_schema: inputs_schema:
properties: properties:
site_ids: { type: string, description: "Comma-separated site IDs." } site_ids: { type: string, description: "Comma-separated site IDs." }
@@ -278,6 +302,7 @@ commands:
- id: fetch_threat_file - id: fetch_threat_file
name: sentinelone-fetch-threat-file name: sentinelone-fetch-threat-file
description: "Request the threat file for download, protected by a ZIP password." description: "Request the threat file for download, protected by a ZIP password."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
threat_id: { type: string, description: "ID of the threat whose file to fetch." } threat_id: { type: string, description: "ID of the threat whose file to fetch." }
@@ -287,6 +312,7 @@ commands:
- id: get_alerts - id: get_alerts
name: sentinelone-get-alerts name: sentinelone-get-alerts
description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria." description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
risk: read
inputs_schema: inputs_schema:
properties: properties:
created_from: { type: string, description: "Return alerts created at or after this timestamp." } created_from: { type: string, description: "Return alerts created at or after this timestamp." }
@@ -307,6 +333,7 @@ commands:
- id: update_alerts_verdict - id: update_alerts_verdict
name: sentinelone-update-alerts-verdict name: sentinelone-update-alerts-verdict
description: "Set the analyst verdict on one or more cloud-detection alerts." description: "Set the analyst verdict on one or more cloud-detection alerts."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." } verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
@@ -316,6 +343,7 @@ commands:
- id: update_alerts_status - id: update_alerts_status
name: sentinelone-update-alerts-status name: sentinelone-update-alerts-status
description: "Set the incident status on one or more cloud-detection alerts." description: "Set the incident status on one or more cloud-detection alerts."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
status: { type: string, description: "in_progress, resolved, or unresolved." } status: { type: string, description: "in_progress, resolved, or unresolved." }
@@ -327,6 +355,7 @@ commands:
- id: get_blocklist - id: get_blocklist
name: sentinelone-get-blocklist name: sentinelone-get-blocklist
description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination." description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
risk: read
inputs_schema: inputs_schema:
properties: properties:
global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." } global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." }
@@ -341,6 +370,7 @@ commands:
- id: add_hash_to_blocklist - id: add_hash_to_blocklist
name: sentinelone-add-hash-to-blocklist name: sentinelone-add-hash-to-blocklist
description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope." description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
os_type: { type: string, description: "Target OS type: windows, linux, or macos." } os_type: { type: string, description: "Target OS type: windows, linux, or macos." }
@@ -356,6 +386,7 @@ commands:
- id: remove_hash_from_blocklist - id: remove_hash_from_blocklist
name: sentinelone-remove-hash-from-blocklist name: sentinelone-remove-hash-from-blocklist
description: "Find blocklist entries matching a SHA1 hash and delete them." description: "Find blocklist entries matching a SHA1 hash and delete them."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
sha1: { type: string, description: "SHA1 hash to remove." } sha1: { type: string, description: "SHA1 hash to remove." }
@@ -365,6 +396,7 @@ commands:
- id: get_white_list - id: get_white_list
name: sentinelone-get-white-list name: sentinelone-get-white-list
description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope." description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
risk: read
inputs_schema: inputs_schema:
properties: properties:
item_ids: { type: string, description: "Comma-separated exclusion item IDs." } item_ids: { type: string, description: "Comma-separated exclusion item IDs." }
@@ -379,6 +411,7 @@ commands:
- id: create_white_list_item - id: create_white_list_item
name: sentinelone-create-white-list-item name: sentinelone-create-white-list-item
description: "Create an exclusion (whitelist) item of the given type and value." description: "Create an exclusion (whitelist) item of the given type and value."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." } exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." }
@@ -394,6 +427,7 @@ commands:
- id: remove_item_from_whitelist - id: remove_item_from_whitelist
name: sentinelone-remove-item-from-whitelist name: sentinelone-remove-item-from-whitelist
description: "Find exclusion items matching a value and delete them." description: "Find exclusion items matching a value and delete them."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
item: { type: string, description: "The exclusion value to find and remove." } item: { type: string, description: "The exclusion value to find and remove." }
@@ -404,6 +438,7 @@ commands:
- id: delete_exclusion - id: delete_exclusion
name: sentinelone-delete-exclusion name: sentinelone-delete-exclusion
description: "Delete exclusion items by their IDs and type." description: "Delete exclusion items by their IDs and type."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
ids: { type: string, description: "Comma-separated exclusion item IDs to delete." } ids: { type: string, description: "Comma-separated exclusion item IDs to delete." }
@@ -413,6 +448,7 @@ commands:
- id: create_ioc - id: create_ioc
name: sentinelone-create-ioc name: sentinelone-create-ioc
description: "Create a threat-intelligence IOC for the given account scope." description: "Create a threat-intelligence IOC for the given account scope."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
name: { type: string, description: "Name of the IOC." } name: { type: string, description: "Name of the IOC." }
@@ -429,6 +465,7 @@ commands:
- id: delete_ioc - id: delete_ioc
name: sentinelone-delete-ioc name: sentinelone-delete-ioc
description: "Delete threat-intelligence IOCs by UUID within the given account scope." description: "Delete threat-intelligence IOCs by UUID within the given account scope."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
account_ids: { type: string, description: "Comma-separated account IDs." } account_ids: { type: string, description: "Comma-separated account IDs." }
@@ -438,6 +475,7 @@ commands:
- id: get_iocs - id: get_iocs
name: sentinelone-get-iocs name: sentinelone-get-iocs
description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name." description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
risk: read
inputs_schema: inputs_schema:
properties: properties:
account_ids: { type: string, description: "Comma-separated account IDs." } account_ids: { type: string, description: "Comma-separated account IDs." }
@@ -453,6 +491,7 @@ commands:
- id: get_activities - id: get_activities
name: sentinelone-get-activities name: sentinelone-get-activities
description: "Retrieve activities, optionally filtered by date, agents, or threats." description: "Retrieve activities, optionally filtered by date, agents, or threats."
risk: read
inputs_schema: inputs_schema:
properties: properties:
created_after: { type: string, description: "Activities created after this timestamp." } created_after: { type: string, description: "Activities created after this timestamp." }
@@ -464,6 +503,7 @@ commands:
- id: get_groups - id: get_groups
name: sentinelone-get-groups name: sentinelone-get-groups
description: "List groups with optional filters." description: "List groups with optional filters."
risk: read
inputs_schema: inputs_schema:
properties: properties:
group_type: { type: string, description: "Group type (static, dynamic)." } group_type: { type: string, description: "Group type (static, dynamic)." }
@@ -477,6 +517,7 @@ commands:
- id: delete_group - id: delete_group
name: sentinelone-delete-group name: sentinelone-delete-group
description: "Delete a group by its ID." description: "Delete a group by its ID."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
group_id: { type: string, description: "ID of the group to delete." } group_id: { type: string, description: "ID of the group to delete." }
@@ -485,6 +526,7 @@ commands:
- id: get_sites - id: get_sites
name: sentinelone-get-sites name: sentinelone-get-sites
description: "List sites with optional filters." description: "List sites with optional filters."
risk: read
inputs_schema: inputs_schema:
properties: properties:
query: { type: string, description: "Free-text search." } query: { type: string, description: "Free-text search." }
@@ -498,6 +540,7 @@ commands:
- id: get_site - id: get_site
name: sentinelone-get-site name: sentinelone-get-site
description: "Retrieve a single site by its ID." description: "Retrieve a single site by its ID."
risk: read
inputs_schema: inputs_schema:
properties: properties:
site_id: { type: string, description: "ID of the site." } site_id: { type: string, description: "ID of the site." }
@@ -506,6 +549,7 @@ commands:
- id: reactivate_site - id: reactivate_site
name: sentinelone-reactivate-site name: sentinelone-reactivate-site
description: "Reactivate an expired site." description: "Reactivate an expired site."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
site_id: { type: string, description: "ID of the site to reactivate." } site_id: { type: string, description: "ID of the site to reactivate." }
@@ -516,6 +560,7 @@ commands:
- id: expire_site - id: expire_site
name: sentinelone-expire-site name: sentinelone-expire-site
description: "Expire a site immediately." description: "Expire a site immediately."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
site_id: { type: string, description: "ID of the site to expire." } site_id: { type: string, description: "ID of the site to expire." }
@@ -524,6 +569,7 @@ commands:
- id: get_accounts - id: get_accounts
name: sentinelone-get-accounts name: sentinelone-get-accounts
description: "List all accounts, or retrieve a single account when an ID is provided." description: "List all accounts, or retrieve a single account when an ID is provided."
risk: read
inputs_schema: inputs_schema:
properties: properties:
account_id: { type: string, description: "Optional account ID." } account_id: { type: string, description: "Optional account ID." }
@@ -532,6 +578,7 @@ commands:
- id: list_users - id: list_users
name: sentinelone-list-users name: sentinelone-list-users
description: "List users, optionally filtered by account IDs." description: "List users, optionally filtered by account IDs."
risk: read
inputs_schema: inputs_schema:
properties: properties:
account_ids: { type: string, description: "Comma-separated account IDs." } account_ids: { type: string, description: "Comma-separated account IDs." }
@@ -541,6 +588,7 @@ commands:
- id: delete_user - id: delete_user
name: sentinelone-delete-user name: sentinelone-delete-user
description: "Delete a user by their ID." description: "Delete a user by their ID."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
user_id: { type: string, description: "ID of the user to delete." } user_id: { type: string, description: "ID of the user to delete." }
@@ -549,6 +597,7 @@ commands:
- id: create_query - id: create_query
name: sentinelone-create-query name: sentinelone-create-query
description: "Initialize a Deep Visibility query over a given time range." description: "Initialize a Deep Visibility query over a given time range."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
query: { type: string, description: "Deep Visibility query string." } query: { type: string, description: "Deep Visibility query string." }
@@ -559,6 +608,7 @@ commands:
- id: get_dv_query_status - id: get_dv_query_status
name: sentinelone-get-dv-query-status name: sentinelone-get-dv-query-status
description: "Get the status of a Deep Visibility query by ID." description: "Get the status of a Deep Visibility query by ID."
risk: read
inputs_schema: inputs_schema:
properties: properties:
query_id: { type: string, description: "ID of the Deep Visibility query." } query_id: { type: string, description: "ID of the Deep Visibility query." }
@@ -567,6 +617,7 @@ commands:
- id: get_events - id: get_events
name: sentinelone-get-events name: sentinelone-get-events
description: "Retrieve events for a completed Deep Visibility query." description: "Retrieve events for a completed Deep Visibility query."
risk: read
inputs_schema: inputs_schema:
properties: properties:
query_id: { type: string, description: "ID of the Deep Visibility query." } query_id: { type: string, description: "ID of the Deep Visibility query." }
@@ -577,6 +628,7 @@ commands:
- id: get_processes - id: get_processes
name: sentinelone-get-processes name: sentinelone-get-processes
description: "Retrieve process events for a completed Deep Visibility query." description: "Retrieve process events for a completed Deep Visibility query."
risk: read
inputs_schema: inputs_schema:
properties: properties:
query_id: { type: string, description: "ID of the Deep Visibility query." } query_id: { type: string, description: "ID of the Deep Visibility query." }
@@ -588,6 +640,7 @@ commands:
- id: create_star_rule - id: create_star_rule
name: sentinelone-create-star-rule name: sentinelone-create-star-rule
description: "Create a STAR custom detection rule in Draft status." description: "Create a STAR custom detection rule in Draft status."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
name: { type: string, description: "Rule name." } name: { type: string, description: "Rule name." }
@@ -607,6 +660,7 @@ commands:
- id: get_star_rules - id: get_star_rules
name: sentinelone-get-star-rules name: sentinelone-get-star-rules
description: "List STAR custom detection rules." description: "List STAR custom detection rules."
risk: read
inputs_schema: inputs_schema:
properties: properties:
status: { type: string, description: "Filter by rule status." } status: { type: string, description: "Filter by rule status." }
@@ -621,6 +675,7 @@ commands:
- id: update_star_rule - id: update_star_rule
name: sentinelone-update-star-rule name: sentinelone-update-star-rule
description: "Update an existing STAR custom detection rule by ID." description: "Update an existing STAR custom detection rule by ID."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
rule_id: { type: string, description: "ID of the rule to update." } rule_id: { type: string, description: "ID of the rule to update." }
@@ -642,6 +697,7 @@ commands:
- id: enable_star_rules - id: enable_star_rules
name: sentinelone-enable-star-rules name: sentinelone-enable-star-rules
description: "Enable one or more STAR custom detection rules by ID." description: "Enable one or more STAR custom detection rules by ID."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
rule_ids: { type: string, description: "Comma-separated rule IDs to enable." } rule_ids: { type: string, description: "Comma-separated rule IDs to enable." }
@@ -650,6 +706,7 @@ commands:
- id: disable_star_rules - id: disable_star_rules
name: sentinelone-disable-star-rules name: sentinelone-disable-star-rules
description: "Disable one or more STAR custom detection rules by ID." description: "Disable one or more STAR custom detection rules by ID."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
rule_ids: { type: string, description: "Comma-separated rule IDs to disable." } rule_ids: { type: string, description: "Comma-separated rule IDs to disable." }
@@ -658,6 +715,7 @@ commands:
- id: delete_star_rule - id: delete_star_rule
name: sentinelone-delete-star-rule name: sentinelone-delete-star-rule
description: "Delete one or more STAR custom detection rules by ID." description: "Delete one or more STAR custom detection rules by ID."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
rule_ids: { type: string, description: "Comma-separated rule IDs to delete." } rule_ids: { type: string, description: "Comma-separated rule IDs to delete." }
@@ -666,6 +724,7 @@ commands:
- id: run_remote_script - id: run_remote_script
name: sentinelone-run-remote-script name: sentinelone-run-remote-script
description: "Execute a remote script (RSO) on the targeted agents." description: "Execute a remote script (RSO) on the targeted agents."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
account_ids: { type: string, description: "Comma-separated account IDs." } account_ids: { type: string, description: "Comma-separated account IDs." }
@@ -682,6 +741,7 @@ commands:
- id: create_endpoint_tag - id: create_endpoint_tag
name: sentinelone-create-endpoint-tag name: sentinelone-create-endpoint-tag
description: "Create an endpoint tag in the tag manager." description: "Create an endpoint tag in the tag manager."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
type: { type: string, description: "Tag type." } type: { type: string, description: "Tag type." }
@@ -697,6 +757,7 @@ commands:
- id: delete_endpoint_tag - id: delete_endpoint_tag
name: sentinelone-delete-endpoint-tag name: sentinelone-delete-endpoint-tag
description: "Delete endpoint tags matching the given scope filter." description: "Delete endpoint tags matching the given scope filter."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
siteIds: { type: string, description: "Comma-separated site IDs." } siteIds: { type: string, description: "Comma-separated site IDs." }
@@ -708,6 +769,7 @@ commands:
- id: get_endpoint_tags - id: get_endpoint_tags
name: sentinelone-get-endpoint-tags name: sentinelone-get-endpoint-tags
description: "List endpoint tags, optionally filtered by key or value substring." description: "List endpoint tags, optionally filtered by key or value substring."
risk: read
inputs_schema: inputs_schema:
properties: properties:
key__contains: { type: string, description: "Filter by key substring." } key__contains: { type: string, description: "Filter by key substring." }
@@ -717,6 +779,7 @@ commands:
- id: create_firewall_rule - id: create_firewall_rule
name: sentinelone-create-firewall-rule name: sentinelone-create-firewall-rule
description: "Create a firewall control rule scoped to an account or site." description: "Create a firewall control rule scoped to an account or site."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
action: { type: string, description: "Allow | Block." } action: { type: string, description: "Allow | Block." }
@@ -732,6 +795,7 @@ commands:
- id: get_network_discovery_table - id: get_network_discovery_table
name: sentinelone-get-network-discovery-table name: sentinelone-get-network-discovery-table
description: "Retrieve the Ranger network discovery table view." description: "Retrieve the Ranger network discovery table view."
risk: read
inputs_schema: inputs_schema:
properties: properties:
hostnames__contains: { type: string, description: "Filter by hostname substring." } hostnames__contains: { type: string, description: "Filter by hostname substring." }
@@ -742,6 +806,7 @@ commands:
- id: get_network_discovery_assets - id: get_network_discovery_assets
name: sentinelone-get-network-discovery-assets name: sentinelone-get-network-discovery-assets
description: "Retrieve XDR network discovery surface assets." description: "Retrieve XDR network discovery surface assets."
risk: read
inputs_schema: inputs_schema:
properties: properties:
limit: { type: number, description: "Max results (default 50)." } limit: { type: number, description: "Max results (default 50)." }
@@ -754,6 +819,7 @@ commands:
- id: get_shadow_assets - id: get_shadow_assets
name: sentinelone-get-shadow-assets name: sentinelone-get-shadow-assets
description: "Retrieve XDR shadow assets with optional coverage filters." description: "Retrieve XDR shadow assets with optional coverage filters."
risk: read
inputs_schema: inputs_schema:
properties: properties:
limit: { type: number, description: "Max results (default 50)." } limit: { type: number, description: "Max results (default 50)." }
@@ -767,6 +833,7 @@ commands:
- id: get_gateways - id: get_gateways
name: sentinelone-get-gateways name: sentinelone-get-gateways
description: "List Ranger gateways." description: "List Ranger gateways."
risk: read
inputs_schema: inputs_schema:
properties: {} properties: {}
required: [] required: []
@@ -774,6 +841,7 @@ commands:
- id: purge_crash_dumps - id: purge_crash_dumps
name: sentinelone-purge-crash-dumps name: sentinelone-purge-crash-dumps
description: "Purge agent crash dumps for the specified agents." description: "Purge agent crash dumps for the specified agents."
risk: destructive
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs." } agent_ids: { type: string, description: "Comma-separated agent IDs." }
@@ -782,6 +850,7 @@ commands:
- id: list_endpoints_with_application - id: list_endpoints_with_application
name: sentinelone-list-endpoints-with-application name: sentinelone-list-endpoints-with-application
description: "List the application inventory across endpoints." description: "List the application inventory across endpoints."
risk: read
inputs_schema: inputs_schema:
properties: properties:
groupIds: { type: string, description: "Comma-separated group IDs." } groupIds: { type: string, description: "Comma-separated group IDs." }
@@ -795,6 +864,7 @@ commands:
- id: get_app_inventory_endpoints - id: get_app_inventory_endpoints
name: sentinelone-get-app-inventory-endpoints name: sentinelone-get-app-inventory-endpoints
description: "List endpoints that have a given application installed." description: "List endpoints that have a given application installed."
risk: read
inputs_schema: inputs_schema:
properties: properties:
applicationName: { type: string, description: "Application name filter." } applicationName: { type: string, description: "Application name filter." }
@@ -811,6 +881,7 @@ commands:
- id: threat_analysis - id: threat_analysis
name: sentinelone-threat-analysis name: sentinelone-threat-analysis
description: "Return the detailed analysis for a threat (agent, detection and threat info)." description: "Return the detailed analysis for a threat (agent, detection and threat info)."
risk: read
inputs_schema: inputs_schema:
properties: properties:
threat_id: { type: string, description: "Threat ID." } threat_id: { type: string, description: "Threat ID." }
@@ -820,6 +891,7 @@ commands:
- id: threat_download_from_cloud - id: threat_download_from_cloud
name: sentinelone-threat-download-from-cloud name: sentinelone-threat-download-from-cloud
description: "Get a download URL for a threat's sample from the cloud (BinaryVault)." description: "Get a download URL for a threat's sample from the cloud (BinaryVault)."
risk: read
inputs_schema: inputs_schema:
properties: properties:
threat_id: { type: string, description: "Threat ID." } threat_id: { type: string, description: "Threat ID." }
@@ -830,6 +902,7 @@ commands:
- id: abort_endpoint_scan - id: abort_endpoint_scan
name: sentinelone-abort-endpoint-scan name: sentinelone-abort-endpoint-scan
description: "Abort the disk scan on the given agents." description: "Abort the disk scan on the given agents."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs." } agent_ids: { type: string, description: "Comma-separated agent IDs." }
@@ -839,6 +912,7 @@ commands:
- id: endpoint_fetch_logs - id: endpoint_fetch_logs
name: sentinelone-endpoint-fetch-logs name: sentinelone-endpoint-fetch-logs
description: "Fetch agent/endpoint logs from the given agents." description: "Fetch agent/endpoint logs from the given agents."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
agent_ids: { type: string, description: "Comma-separated agent IDs." } agent_ids: { type: string, description: "Comma-separated agent IDs." }
@@ -851,6 +925,7 @@ commands:
- id: fetch_file - id: fetch_file
name: sentinelone-fetch-file name: sentinelone-fetch-file
description: "Request a file fetch from an agent endpoint (collected as a password-protected zip)." description: "Request a file fetch from an agent endpoint (collected as a password-protected zip)."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
agent_id: { type: string, description: "Agent ID." } agent_id: { type: string, description: "Agent ID." }
@@ -863,6 +938,7 @@ commands:
- id: get_remote_script_task_status - id: get_remote_script_task_status
name: sentinelone-get-remote-script-task-status name: sentinelone-get-remote-script-task-status
description: "Get the status of remote-script tasks for a parent task." description: "Get the status of remote-script tasks for a parent task."
risk: read
inputs_schema: inputs_schema:
properties: properties:
parent_task_id: { type: string, description: "Parent task ID." } parent_task_id: { type: string, description: "Parent task ID." }
@@ -878,6 +954,7 @@ commands:
- id: get_remote_script_task_results - id: get_remote_script_task_results
name: sentinelone-get-remote-script-task-results name: sentinelone-get-remote-script-task-results
description: "Get download links for the results of remote-script tasks." description: "Get download links for the results of remote-script tasks."
risk: read
inputs_schema: inputs_schema:
properties: properties:
task_ids: { type: string, description: "Comma-separated task IDs." } task_ids: { type: string, description: "Comma-separated task IDs." }
@@ -889,6 +966,7 @@ commands:
- id: get_service_users - id: get_service_users
name: sentinelone-get-service-users name: sentinelone-get-service-users
description: "List service users (API token accounts)." description: "List service users (API token accounts)."
risk: read
inputs_schema: inputs_schema:
properties: properties:
account_ids: { type: string, description: "Comma-separated account IDs." } account_ids: { type: string, description: "Comma-separated account IDs." }
@@ -902,6 +980,7 @@ commands:
- id: list_installed_singularity_marketplace_applications - id: list_installed_singularity_marketplace_applications
name: sentinelone-list-installed-singularity-marketplace-applications name: sentinelone-list-installed-singularity-marketplace-applications
description: "List installed Singularity Marketplace applications." description: "List installed Singularity Marketplace applications."
risk: read
inputs_schema: inputs_schema:
properties: properties:
account_ids: { type: string, description: "Comma-separated account IDs." } account_ids: { type: string, description: "Comma-separated account IDs." }
@@ -944,6 +1023,7 @@ commands:
- id: update_uam_alert_status - id: update_uam_alert_status
name: sentinelone-update-uam-alert-status name: sentinelone-update-uam-alert-status
description: "Update the status of a unified (UAM) alert." description: "Update the status of a unified (UAM) alert."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
alert_id: { type: string, description: "UAM alert ID (UUID)." } alert_id: { type: string, description: "UAM alert ID (UUID)." }
@@ -954,6 +1034,7 @@ commands:
- id: update_uam_alert_verdict - id: update_uam_alert_verdict
name: sentinelone-update-uam-alert-verdict name: sentinelone-update-uam-alert-verdict
description: "Update the analyst verdict of a unified (UAM) alert." description: "Update the analyst verdict of a unified (UAM) alert."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
alert_id: { type: string, description: "UAM alert ID (UUID)." } alert_id: { type: string, description: "UAM alert ID (UUID)." }
@@ -965,6 +1046,7 @@ commands:
- id: run_powerquery - id: run_powerquery
name: sentinelone-run-powerquery name: sentinelone-run-powerquery
description: "Run a PowerQuery against the Singularity Data Lake (separate XDR URL + Log Read API key)." description: "Run a PowerQuery against the Singularity Data Lake (separate XDR URL + Log Read API key)."
risk: read
inputs_schema: inputs_schema:
properties: properties:
singularity_xdr_url: { type: string, description: "Singularity Data Lake XDR URL (https://...)." } singularity_xdr_url: { type: string, description: "Singularity Data Lake XDR URL (https://...)." }
@@ -982,6 +1064,7 @@ commands:
- id: create_tag_rule - id: create_tag_rule
name: sentinelone-create-tag-rule name: sentinelone-create-tag-rule
description: "Create a dynamic asset tag rule (XDR) that tags assets matching a property filter." description: "Create a dynamic asset tag rule (XDR) that tags assets matching a property filter."
risk: safe_write
inputs_schema: inputs_schema:
properties: properties:
name: { type: string, description: "Rule name." } name: { type: string, description: "Rule name." }