From e3e363c2f9ae9b3d252816239a479e020c038aea Mon Sep 17 00:00:00 2001
From: Guillaume BOURGEOIS <ducataddict@gmail.com>
Date: Mon, 22 Jun 2026 14:41:22 +0200
Subject: [PATCH] feat(marketplace): prefix official command names with the
 technology

Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
---
 integrations/harfanglab/manifest.yaml  | 146 ++++++++++++-------------
 integrations/sentinelone/manifest.yaml | 144 ++++++++++++------------
 2 files changed, 145 insertions(+), 145 deletions(-)

diff --git a/integrations/harfanglab/manifest.yaml b/integrations/harfanglab/manifest.yaml
index 344e8a8..3316891 100644
--- a/integrations/harfanglab/manifest.yaml
+++ b/integrations/harfanglab/manifest.yaml
@@ -1,8 +1,8 @@
 id: harfanglab
 name: HarfangLab EDR
-version: 1.0.0
+version: 1.1.0
 description: "HarfangLab EDR — endpoint detection & response: endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
-changelog: "1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
+changelog: "1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
 category: endpoint
 
 # Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
@@ -32,7 +32,7 @@ auth:
 commands:
   # ── Endpoints / agents ────────────────────────────────────────────────────
   - id: get_endpoint_info
-    name: Get endpoint info
+    name: harfanglab-get-endpoint-info
     description: Get endpoint (agent) information by agent ID.
     inputs_schema:
       properties:
@@ -40,7 +40,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: endpoint_search
-    name: Endpoint search
+    name: harfanglab-endpoint-search
     description: Search endpoints (agents) by hostname.
     inputs_schema:
       properties:
@@ -48,7 +48,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: isolate_endpoint
-    name: Isolate endpoint
+    name: harfanglab-isolate-endpoint
     description: Network-isolate an endpoint (agent) by agent ID.
     inputs_schema:
       properties:
@@ -56,7 +56,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: deisolate_endpoint
-    name: Deisolate endpoint
+    name: harfanglab-deisolate-endpoint
     description: Remove network isolation from an endpoint (agent) by agent ID.
     inputs_schema:
       properties:
@@ -64,7 +64,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: assign_policy_to_agent
-    name: Assign policy to agent
+    name: harfanglab-assign-policy-to-agent
     description: Assign a security policy to an agent by policy name and agent ID.
     inputs_schema:
       properties:
@@ -75,7 +75,7 @@ commands:
 
   # ── Threat intelligence: whitelists ───────────────────────────────────────
   - id: whitelist_search
-    name: Search whitelists
+    name: harfanglab-whitelist-search
     description: Search threat-intelligence whitelists by keyword.
     inputs_schema:
       properties:
@@ -84,7 +84,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: whitelist_add
-    name: Add whitelist
+    name: harfanglab-whitelist-add
     description: Create a threat-intelligence whitelist rule with an initial criterion.
     inputs_schema:
       properties:
@@ -98,7 +98,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: whitelist_add_criterion
-    name: Add whitelist criterion
+    name: harfanglab-whitelist-add-criterion
     description: Append a criterion to an existing whitelist rule.
     inputs_schema:
       properties:
@@ -110,7 +110,7 @@ commands:
       required: [id]
     outputs_schema: { properties: {} }
   - id: whitelist_delete
-    name: Delete whitelist
+    name: harfanglab-whitelist-delete
     description: Delete a threat-intelligence whitelist rule by id.
     inputs_schema:
       properties:
@@ -120,7 +120,7 @@ commands:
 
   # ── Threat intelligence: IOCs ─────────────────────────────────────────────
   - id: add_ioc_to_source
-    name: Add IOC to source
+    name: harfanglab-add-ioc-to-source
     description: Add an IOC to a named IOC source if it does not already exist.
     inputs_schema:
       properties:
@@ -132,7 +132,7 @@ commands:
       required: [ioc_value, ioc_type, ioc_status, source_name]
     outputs_schema: { properties: {} }
   - id: delete_ioc_from_source
-    name: Delete IOC from source
+    name: harfanglab-delete-ioc-from-source
     description: Remove an IOC from a named IOC source if it exists.
     inputs_schema:
       properties:
@@ -143,7 +143,7 @@ commands:
 
   # ── Security events ───────────────────────────────────────────────────────
   - id: change_security_event_status
-    name: Change security event status
+    name: harfanglab-change-security-event-status
     description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
     inputs_schema:
       properties:
@@ -154,7 +154,7 @@ commands:
 
   # ── Generic / utility ─────────────────────────────────────────────────────
   - id: api_call
-    name: API call
+    name: harfanglab-api-call
     description: "Perform a generic authenticated call to the HarfangLab API."
     inputs_schema:
       properties:
@@ -165,7 +165,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_process_graph
-    name: Telemetry process graph
+    name: harfanglab-telemetry-process-graph
     description: "Retrieve the process graph for a telemetry process UUID."
     inputs_schema:
       properties:
@@ -175,7 +175,7 @@ commands:
 
   # ── Threat hunting by hash ────────────────────────────────────────────────
   - id: hunt_search_hash
-    name: Hunt search hash
+    name: harfanglab-hunt-search-hash
     description: "Search the data explorer for a file hash."
     inputs_schema:
       properties:
@@ -183,7 +183,7 @@ commands:
       required: [hash]
     outputs_schema: { properties: {} }
   - id: hunt_search_running_process_hash
-    name: Hunt search running process by hash
+    name: harfanglab-hunt-search-running-process-hash
     description: "Hunt for currently running processes matching a SHA-256 hash."
     inputs_schema:
       properties:
@@ -191,7 +191,7 @@ commands:
       required: [hash]
     outputs_schema: { properties: {} }
   - id: hunt_search_runned_process_hash
-    name: Hunt search runned process by hash
+    name: harfanglab-hunt-search-runned-process-hash
     description: "Search process telemetry for executions matching a SHA-256 hash."
     inputs_schema:
       properties:
@@ -201,7 +201,7 @@ commands:
 
   # ── Telemetry ─────────────────────────────────────────────────────────────
   - id: telemetry_processes
-    name: Telemetry — processes
+    name: harfanglab-telemetry-processes
     description: Search process telemetry.
     inputs_schema:
       properties:
@@ -213,7 +213,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_dns
-    name: Telemetry — DNS resolution
+    name: harfanglab-telemetry-dns
     description: Search DNS resolution telemetry.
     inputs_schema:
       properties:
@@ -226,7 +226,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_network
-    name: Telemetry — network
+    name: harfanglab-telemetry-network
     description: Search network connection telemetry.
     inputs_schema:
       properties:
@@ -241,7 +241,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_eventlog
-    name: Telemetry — event log
+    name: harfanglab-telemetry-eventlog
     description: Search Windows full event log telemetry.
     inputs_schema:
       properties:
@@ -253,7 +253,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_binary
-    name: Telemetry — binary
+    name: harfanglab-telemetry-binary
     description: Search binary telemetry.
     inputs_schema:
       properties:
@@ -264,7 +264,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_authentication_windows
-    name: Telemetry — Windows authentication
+    name: harfanglab-telemetry-authentication-windows
     description: Search Windows authentication telemetry.
     inputs_schema:
       properties:
@@ -281,7 +281,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_authentication_linux
-    name: Telemetry — Linux authentication
+    name: harfanglab-telemetry-authentication-linux
     description: Search Linux authentication telemetry.
     inputs_schema:
       properties:
@@ -296,7 +296,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_authentication_macos
-    name: Telemetry — macOS authentication
+    name: harfanglab-telemetry-authentication-macos
     description: Search macOS authentication telemetry.
     inputs_schema:
       properties:
@@ -311,7 +311,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: telemetry_authentication_users
-    name: Telemetry — top authenticating users
+    name: harfanglab-telemetry-authentication-users
     description: Rank users by authentication attempts across Windows, Linux and macOS.
     inputs_schema:
       properties:
@@ -324,7 +324,7 @@ commands:
 
   # ── Collection jobs ───────────────────────────────────────────────────────
   - id: job_pipelist
-    name: Job — list pipes
+    name: harfanglab-job-pipelist
     description: Start a job to list named pipes on a host (Windows).
     inputs_schema:
       properties:
@@ -332,7 +332,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_prefetchlist
-    name: Job — list prefetch
+    name: harfanglab-job-prefetchlist
     description: Start a job to collect Windows prefetch files on a host.
     inputs_schema:
       properties:
@@ -340,7 +340,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_runkeylist
-    name: Job — list run keys
+    name: harfanglab-job-runkeylist
     description: Start a job to collect registry run keys (hives) on a host.
     inputs_schema:
       properties:
@@ -348,7 +348,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_scheduledtasklist
-    name: Job — list scheduled tasks
+    name: harfanglab-job-scheduledtasklist
     description: Start a job to list scheduled tasks on a host.
     inputs_schema:
       properties:
@@ -356,7 +356,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_driverlist
-    name: Job — list drivers
+    name: harfanglab-job-driverlist
     description: Start a job to list loaded drivers on a host.
     inputs_schema:
       properties:
@@ -364,7 +364,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_servicelist
-    name: Job — list services
+    name: harfanglab-job-servicelist
     description: Start a job to collect services from registry hives on a host.
     inputs_schema:
       properties:
@@ -372,7 +372,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_processlist
-    name: Job — list processes
+    name: harfanglab-job-processlist
     description: Start a job to list running processes with signature info on a host.
     inputs_schema:
       properties:
@@ -380,7 +380,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_networkconnectionlist
-    name: Job — list network connections
+    name: harfanglab-job-networkconnectionlist
     description: Start a job to list processes with their active network connections on a host.
     inputs_schema:
       properties:
@@ -388,7 +388,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_networksharelist
-    name: Job — list network shares
+    name: harfanglab-job-networksharelist
     description: Start a job to list network shares on a host.
     inputs_schema:
       properties:
@@ -396,7 +396,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_sessionlist
-    name: Job — list sessions
+    name: harfanglab-job-sessionlist
     description: Start a job to list active user sessions on a host.
     inputs_schema:
       properties:
@@ -404,7 +404,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_persistencelist
-    name: Job — list persistence
+    name: harfanglab-job-persistencelist
     description: Start a job to scan for persistence mechanisms on a host.
     inputs_schema:
       properties:
@@ -412,7 +412,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_startuplist
-    name: Job — list startup files
+    name: harfanglab-job-startuplist
     description: Start a job to list startup files on a host.
     inputs_schema:
       properties:
@@ -420,7 +420,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_wmilist
-    name: Job — list WMI
+    name: harfanglab-job-wmilist
     description: Start a job to collect WMI persistence artifacts on a host.
     inputs_schema:
       properties:
@@ -428,7 +428,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_ioc
-    name: Job — IOC scan
+    name: harfanglab-job-ioc
     description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
     inputs_schema:
       properties:
@@ -444,7 +444,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_info
-    name: Job — get job info
+    name: harfanglab-job-info
     description: Retrieve information for one or more jobs by their identifiers.
     inputs_schema:
       properties:
@@ -454,7 +454,7 @@ commands:
 
   # ── Forensic artifact collection jobs ─────────────────────────────────────
   - id: job_artifact_mft
-    name: Job — collect MFT
+    name: harfanglab-job-artifact-mft
     description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
     inputs_schema:
       properties:
@@ -462,7 +462,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_hives
-    name: Job — collect registry hives
+    name: harfanglab-job-artifact-hives
     description: Start a job to collect the Windows registry hives from a host.
     inputs_schema:
       properties:
@@ -470,7 +470,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_evtx
-    name: Job — collect event logs
+    name: harfanglab-job-artifact-evtx
     description: Start a job to collect the Windows event logs (EVTX) from a host.
     inputs_schema:
       properties:
@@ -478,7 +478,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_logs
-    name: Job — collect system logs
+    name: harfanglab-job-artifact-logs
     description: Start a job to collect the system logs from a host.
     inputs_schema:
       properties:
@@ -486,7 +486,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_filesystem
-    name: Job — collect filesystem listing
+    name: harfanglab-job-artifact-filesystem
     description: Start a job to collect the filesystem listing from a host.
     inputs_schema:
       properties:
@@ -494,7 +494,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_all
-    name: Job — collect all raw evidence
+    name: harfanglab-job-artifact-all
     description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
     inputs_schema:
       properties:
@@ -502,7 +502,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_ramdump
-    name: Job — dump RAM
+    name: harfanglab-job-artifact-ramdump
     description: Start a job to capture a full memory (RAM) dump from a host.
     inputs_schema:
       properties:
@@ -510,7 +510,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: job_artifact_downloadfile
-    name: Job — download file
+    name: harfanglab-job-artifact-downloadfile
     description: Start a job to download a specific file from a host by its full path.
     inputs_schema:
       properties:
@@ -521,7 +521,7 @@ commands:
 
   # ── Job results (hunting) ─────────────────────────────────────────────────
   - id: result_pipelist
-    name: Result — pipes
+    name: harfanglab-result-pipelist
     description: Get a host's list of named pipes from a job result.
     inputs_schema:
       properties:
@@ -529,7 +529,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_prefetchlist
-    name: Result — prefetch
+    name: harfanglab-result-prefetchlist
     description: Get a host's prefetch entries from a job result.
     inputs_schema:
       properties:
@@ -537,7 +537,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_runkeylist
-    name: Result — run keys
+    name: harfanglab-result-runkeylist
     description: Get a host's registry run keys from a job result.
     inputs_schema:
       properties:
@@ -545,7 +545,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_scheduledtasklist
-    name: Result — scheduled tasks
+    name: harfanglab-result-scheduledtasklist
     description: Get a host's scheduled tasks from a job result.
     inputs_schema:
       properties:
@@ -553,7 +553,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_driverlist
-    name: Result — drivers
+    name: harfanglab-result-driverlist
     description: Get a host's list of drivers from a job result.
     inputs_schema:
       properties:
@@ -561,7 +561,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_servicelist
-    name: Result — services
+    name: harfanglab-result-servicelist
     description: Get a host's list of services from a job result.
     inputs_schema:
       properties:
@@ -569,7 +569,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_processlist
-    name: Result — processes
+    name: harfanglab-result-processlist
     description: Get a host's list of running processes from a job result.
     inputs_schema:
       properties:
@@ -577,7 +577,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_networkconnectionlist
-    name: Result — network connections
+    name: harfanglab-result-networkconnectionlist
     description: Get a host's network connections from a job result.
     inputs_schema:
       properties:
@@ -585,7 +585,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_networksharelist
-    name: Result — network shares
+    name: harfanglab-result-networksharelist
     description: Get a host's list of network shares from a job result.
     inputs_schema:
       properties:
@@ -593,7 +593,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_sessionlist
-    name: Result — sessions
+    name: harfanglab-result-sessionlist
     description: Get a host's list of user sessions from a job result.
     inputs_schema:
       properties:
@@ -601,7 +601,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_persistencelist
-    name: Result — persistence
+    name: harfanglab-result-persistencelist
     description: Get a host's persistence files from a job result.
     inputs_schema:
       properties:
@@ -609,7 +609,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_startuplist
-    name: Result — startup items
+    name: harfanglab-result-startuplist
     description: Get a host's startup items from a job result.
     inputs_schema:
       properties:
@@ -617,7 +617,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_wmilist
-    name: Result — WMI
+    name: harfanglab-result-wmilist
     description: Get a host's WMI persistence entries from a job result.
     inputs_schema:
       properties:
@@ -625,7 +625,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_ioc
-    name: Result — IOC matches
+    name: harfanglab-result-ioc
     description: Get a host's IOC matches from a job result.
     inputs_schema:
       properties:
@@ -635,7 +635,7 @@ commands:
 
   # ── Job results (forensic artifacts) ──────────────────────────────────────
   - id: result_artifact_mft
-    name: Result — MFT artifact
+    name: harfanglab-result-artifact-mft
     description: Get the MFT download links from a collection job result.
     inputs_schema:
       properties:
@@ -643,7 +643,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_hives
-    name: Result — Registry hives artifact
+    name: harfanglab-result-artifact-hives
     description: Get the Windows registry hive download links from a collection job result.
     inputs_schema:
       properties:
@@ -651,7 +651,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_evtx
-    name: Result — EVTX artifact
+    name: harfanglab-result-artifact-evtx
     description: Get the Windows event log (EVTX) download links from a collection job result.
     inputs_schema:
       properties:
@@ -659,7 +659,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_logs
-    name: Result — Linux logs artifact
+    name: harfanglab-result-artifact-logs
     description: Get the Linux system log download links from a collection job result.
     inputs_schema:
       properties:
@@ -667,7 +667,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_filesystem
-    name: Result — Filesystem artifact
+    name: harfanglab-result-artifact-filesystem
     description: Get the filesystem listing download links from a collection job result.
     inputs_schema:
       properties:
@@ -675,7 +675,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_all
-    name: Result — All artifacts
+    name: harfanglab-result-artifact-all
     description: Get the download links for all collected artifacts from a collection job result.
     inputs_schema:
       properties:
@@ -683,7 +683,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_downloadfile
-    name: Result — Downloaded file artifact
+    name: harfanglab-result-artifact-downloadfile
     description: Get the download link for a file retrieved by a download-file job result.
     inputs_schema:
       properties:
@@ -691,7 +691,7 @@ commands:
       required: [job_id]
     outputs_schema: { properties: {} }
   - id: result_artifact_ramdump
-    name: Result — RAM dump artifact
+    name: harfanglab-result-artifact-ramdump
     description: Get the memory (RAM) dump download links from a collection job result.
     inputs_schema:
       properties:
diff --git a/integrations/sentinelone/manifest.yaml b/integrations/sentinelone/manifest.yaml
index 76c615f..d13bf12 100644
--- a/integrations/sentinelone/manifest.yaml
+++ b/integrations/sentinelone/manifest.yaml
@@ -1,8 +1,8 @@
 id: sentinelone
 name: SentinelOne
-version: 1.0.0
+version: 1.1.0
 description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
-changelog: "1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
+changelog: "1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
 category: endpoint
 
 # Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
@@ -32,7 +32,7 @@ auth:
 commands:
   # ── Enrichment / read ─────────────────────────────────────────────────────
   - id: get_threats
-    name: Get threats
+    name: sentinelone-get-threats
     description: List threats/detections matching filters.
     inputs_schema:
       properties:
@@ -45,7 +45,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: list_agents
-    name: List agents
+    name: sentinelone-list-agents
     description: List endpoints (agents) matching filters.
     inputs_schema:
       properties:
@@ -57,7 +57,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: get_agent
-    name: Get agent
+    name: sentinelone-get-agent
     description: Get details for one or more agents by ID.
     inputs_schema:
       properties:
@@ -66,7 +66,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: get_hash_verdict
-    name: Get hash verdict
+    name: sentinelone-get-hash-verdict
     description: Reputation verdict for a SHA1 hash.
     inputs_schema:
       properties:
@@ -76,7 +76,7 @@ commands:
 
   # ── Response ──────────────────────────────────────────────────────────────
   - id: isolate_agent
-    name: Isolate agent (disconnect)
+    name: sentinelone-isolate-agent
     description: Disconnect agents from the network.
     inputs_schema:
       properties:
@@ -85,7 +85,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: reconnect_agent
-    name: Reconnect agent
+    name: sentinelone-reconnect-agent
     description: Reconnect agents to the network.
     inputs_schema:
       properties:
@@ -94,7 +94,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: mitigate_threat
-    name: Mitigate threat
+    name: sentinelone-mitigate-threat
     description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
     inputs_schema:
       properties:
@@ -104,7 +104,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: initiate_scan
-    name: Initiate endpoint scan
+    name: sentinelone-initiate-scan
     description: Start a full disk scan on agents.
     inputs_schema:
       properties:
@@ -113,7 +113,7 @@ commands:
     outputs_schema: { properties: {} }
 
   - id: write_threat_note
-    name: Add threat note
+    name: sentinelone-write-threat-note
     description: Add a note to one or more threats.
     inputs_schema:
       properties:
@@ -124,7 +124,7 @@ commands:
 
   # ── Agents: actions & info ────────────────────────────────────────────────
   - id: shutdown_agent
-    name: Shutdown agent
+    name: sentinelone-shutdown-agent
     description: "Send a shutdown command to agents matching the filter."
     inputs_schema:
       properties:
@@ -134,7 +134,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: uninstall_agent
-    name: Uninstall agent
+    name: sentinelone-uninstall-agent
     description: "Send an uninstall command to agents matching the filter."
     inputs_schema:
       properties:
@@ -144,7 +144,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: broadcast_message
-    name: Broadcast message
+    name: sentinelone-broadcast-message
     description: "Broadcast a message to agents matching the filter."
     inputs_schema:
       properties:
@@ -155,7 +155,7 @@ commands:
       required: [message]
     outputs_schema: { properties: {} }
   - id: enable_agent
-    name: Enable agent
+    name: sentinelone-enable-agent
     description: "Enable agents matching the given IDs, optionally rebooting them."
     inputs_schema:
       properties:
@@ -164,7 +164,7 @@ commands:
       required: [agent_ids]
     outputs_schema: { properties: {} }
   - id: move_agent
-    name: Move agent
+    name: sentinelone-move-agent
     description: "Move agents into the specified group."
     inputs_schema:
       properties:
@@ -173,7 +173,7 @@ commands:
       required: [group_id, agents_ids]
     outputs_schema: { properties: {} }
   - id: count_agents
-    name: Count agents
+    name: sentinelone-count-agents
     description: "Count agents matching the given filters."
     inputs_schema:
       properties:
@@ -185,7 +185,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_agent_mac
-    name: Get agent MAC addresses
+    name: sentinelone-get-agent-mac
     description: "Retrieve network interfaces (IP and MAC) for a single agent."
     inputs_schema:
       properties:
@@ -193,7 +193,7 @@ commands:
       required: [agent_id]
     outputs_schema: { properties: {} }
   - id: get_installed_applications
-    name: Get installed applications
+    name: sentinelone-get-installed-applications
     description: "Retrieve the applications installed on the given agents."
     inputs_schema:
       properties:
@@ -201,7 +201,7 @@ commands:
       required: [agent_ids]
     outputs_schema: { properties: {} }
   - id: manage_tags
-    name: Manage tags
+    name: sentinelone-manage-tags
     description: "Add, override or remove a tag on the given agents."
     inputs_schema:
       properties:
@@ -213,7 +213,7 @@ commands:
 
   # ── Threats & Alerts ──────────────────────────────────────────────────────
   - id: resolve_threat
-    name: Resolve threat
+    name: sentinelone-resolve-threat
     description: "Mark one or more threats as resolved."
     inputs_schema:
       properties:
@@ -221,7 +221,7 @@ commands:
       required: [threat_ids]
     outputs_schema: { properties: {} }
   - id: mark_as_threat
-    name: Mark as threat
+    name: sentinelone-mark-as-threat
     description: "Mark detections as a true threat, scoped to a site or the whole tenant."
     inputs_schema:
       properties:
@@ -230,7 +230,7 @@ commands:
       required: [threat_ids, target_scope]
     outputs_schema: { properties: {} }
   - id: update_threats_verdict
-    name: Update threats verdict
+    name: sentinelone-update-threats-verdict
     description: "Set the analyst verdict on one or more threats."
     inputs_schema:
       properties:
@@ -239,7 +239,7 @@ commands:
       required: [verdict, threat_ids]
     outputs_schema: { properties: {} }
   - id: update_threats_status
-    name: Update threats status
+    name: sentinelone-update-threats-status
     description: "Set the incident status on one or more threats."
     inputs_schema:
       properties:
@@ -248,7 +248,7 @@ commands:
       required: [status, threat_ids]
     outputs_schema: { properties: {} }
   - id: get_threat_notes
-    name: Get threat notes
+    name: sentinelone-get-threat-notes
     description: "Retrieve the notes attached to a single threat."
     inputs_schema:
       properties:
@@ -256,7 +256,7 @@ commands:
       required: [threat_id]
     outputs_schema: { properties: {} }
   - id: get_threat_summary
-    name: Get threat summary
+    name: sentinelone-get-threat-summary
     description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
     inputs_schema:
       properties:
@@ -265,7 +265,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: fetch_threat_file
-    name: Fetch threat file
+    name: sentinelone-fetch-threat-file
     description: "Request the threat file for download, protected by a ZIP password."
     inputs_schema:
       properties:
@@ -274,7 +274,7 @@ commands:
       required: [threat_id, password]
     outputs_schema: { properties: {} }
   - id: get_alerts
-    name: Get alerts
+    name: sentinelone-get-alerts
     description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
     inputs_schema:
       properties:
@@ -289,7 +289,7 @@ commands:
       required: [created_from]
     outputs_schema: { properties: {} }
   - id: update_alerts_verdict
-    name: Update alerts verdict
+    name: sentinelone-update-alerts-verdict
     description: "Set the analyst verdict on one or more cloud-detection alerts."
     inputs_schema:
       properties:
@@ -298,7 +298,7 @@ commands:
       required: [verdict, alert_ids]
     outputs_schema: { properties: {} }
   - id: update_alerts_status
-    name: Update alerts status
+    name: sentinelone-update-alerts-status
     description: "Set the incident status on one or more cloud-detection alerts."
     inputs_schema:
       properties:
@@ -309,7 +309,7 @@ commands:
 
   # ── Hash, blocklist, exclusions, IOCs ─────────────────────────────────────
   - id: get_blocklist
-    name: Get blocklist
+    name: sentinelone-get-blocklist
     description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
     inputs_schema:
       properties:
@@ -323,7 +323,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: add_hash_to_blocklist
-    name: Add hash to blocklist
+    name: sentinelone-add-hash-to-blocklist
     description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
     inputs_schema:
       properties:
@@ -338,7 +338,7 @@ commands:
       required: [os_type]
     outputs_schema: { properties: {} }
   - id: remove_hash_from_blocklist
-    name: Remove hash from blocklist
+    name: sentinelone-remove-hash-from-blocklist
     description: "Find blocklist entries matching a SHA1 hash and delete them."
     inputs_schema:
       properties:
@@ -347,7 +347,7 @@ commands:
       required: [sha1]
     outputs_schema: { properties: {} }
   - id: get_white_list
-    name: Get exclusions (white list)
+    name: sentinelone-get-white-list
     description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
     inputs_schema:
       properties:
@@ -361,7 +361,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: create_white_list_item
-    name: Create exclusion item
+    name: sentinelone-create-white-list-item
     description: "Create an exclusion (whitelist) item of the given type and value."
     inputs_schema:
       properties:
@@ -376,7 +376,7 @@ commands:
       required: [exclusion_type, exclusion_value, os_type]
     outputs_schema: { properties: {} }
   - id: remove_item_from_whitelist
-    name: Remove exclusion item
+    name: sentinelone-remove-item-from-whitelist
     description: "Find exclusion items matching a value and delete them."
     inputs_schema:
       properties:
@@ -386,7 +386,7 @@ commands:
       required: [item]
     outputs_schema: { properties: {} }
   - id: delete_exclusion
-    name: Delete exclusion
+    name: sentinelone-delete-exclusion
     description: "Delete exclusion items by their IDs and type."
     inputs_schema:
       properties:
@@ -395,7 +395,7 @@ commands:
       required: [ids, type]
     outputs_schema: { properties: {} }
   - id: create_ioc
-    name: Create IOC
+    name: sentinelone-create-ioc
     description: "Create a threat-intelligence IOC for the given account scope."
     inputs_schema:
       properties:
@@ -411,7 +411,7 @@ commands:
       required: [name, source, type, method, validUntil, value, account_ids]
     outputs_schema: { properties: {} }
   - id: delete_ioc
-    name: Delete IOC
+    name: sentinelone-delete-ioc
     description: "Delete threat-intelligence IOCs by UUID within the given account scope."
     inputs_schema:
       properties:
@@ -420,7 +420,7 @@ commands:
       required: [account_ids, uuids]
     outputs_schema: { properties: {} }
   - id: get_iocs
-    name: Get IOCs
+    name: sentinelone-get-iocs
     description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
     inputs_schema:
       properties:
@@ -435,7 +435,7 @@ commands:
 
   # ── Sites, groups, accounts, users, Deep Visibility ───────────────────────
   - id: get_activities
-    name: Get activities
+    name: sentinelone-get-activities
     description: "Retrieve activities, optionally filtered by date, agents, or threats."
     inputs_schema:
       properties:
@@ -446,7 +446,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_groups
-    name: Get groups
+    name: sentinelone-get-groups
     description: "List groups with optional filters."
     inputs_schema:
       properties:
@@ -459,7 +459,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: delete_group
-    name: Delete group
+    name: sentinelone-delete-group
     description: "Delete a group by its ID."
     inputs_schema:
       properties:
@@ -467,7 +467,7 @@ commands:
       required: [group_id]
     outputs_schema: { properties: {} }
   - id: get_sites
-    name: Get sites
+    name: sentinelone-get-sites
     description: "List sites with optional filters."
     inputs_schema:
       properties:
@@ -480,7 +480,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_site
-    name: Get site
+    name: sentinelone-get-site
     description: "Retrieve a single site by its ID."
     inputs_schema:
       properties:
@@ -488,7 +488,7 @@ commands:
       required: [site_id]
     outputs_schema: { properties: {} }
   - id: reactivate_site
-    name: Reactivate site
+    name: sentinelone-reactivate-site
     description: "Reactivate an expired site."
     inputs_schema:
       properties:
@@ -498,7 +498,7 @@ commands:
       required: [site_id]
     outputs_schema: { properties: {} }
   - id: expire_site
-    name: Expire site
+    name: sentinelone-expire-site
     description: "Expire a site immediately."
     inputs_schema:
       properties:
@@ -506,7 +506,7 @@ commands:
       required: [site_id]
     outputs_schema: { properties: {} }
   - id: get_accounts
-    name: Get accounts
+    name: sentinelone-get-accounts
     description: "List all accounts, or retrieve a single account when an ID is provided."
     inputs_schema:
       properties:
@@ -514,7 +514,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: list_users
-    name: List users
+    name: sentinelone-list-users
     description: "List users, optionally filtered by account IDs."
     inputs_schema:
       properties:
@@ -523,7 +523,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: delete_user
-    name: Delete user
+    name: sentinelone-delete-user
     description: "Delete a user by their ID."
     inputs_schema:
       properties:
@@ -531,7 +531,7 @@ commands:
       required: [user_id]
     outputs_schema: { properties: {} }
   - id: create_query
-    name: Create DV query
+    name: sentinelone-create-query
     description: "Initialize a Deep Visibility query over a given time range."
     inputs_schema:
       properties:
@@ -541,7 +541,7 @@ commands:
       required: [query, from_date, to_date]
     outputs_schema: { properties: {} }
   - id: get_dv_query_status
-    name: Get DV query status
+    name: sentinelone-get-dv-query-status
     description: "Get the status of a Deep Visibility query by ID."
     inputs_schema:
       properties:
@@ -549,7 +549,7 @@ commands:
       required: [query_id]
     outputs_schema: { properties: {} }
   - id: get_events
-    name: Get DV events
+    name: sentinelone-get-events
     description: "Retrieve events for a completed Deep Visibility query."
     inputs_schema:
       properties:
@@ -559,7 +559,7 @@ commands:
       required: [query_id]
     outputs_schema: { properties: {} }
   - id: get_processes
-    name: Get DV processes
+    name: sentinelone-get-processes
     description: "Retrieve process events for a completed Deep Visibility query."
     inputs_schema:
       properties:
@@ -570,7 +570,7 @@ commands:
 
   # ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ──────
   - id: create_star_rule
-    name: Create STAR rule
+    name: sentinelone-create-star-rule
     description: "Create a STAR custom detection rule in Draft status."
     inputs_schema:
       properties:
@@ -589,7 +589,7 @@ commands:
       required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
     outputs_schema: { properties: {} }
   - id: get_star_rules
-    name: Get STAR rules
+    name: sentinelone-get-star-rules
     description: "List STAR custom detection rules."
     inputs_schema:
       properties:
@@ -603,7 +603,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: update_star_rule
-    name: Update STAR rule
+    name: sentinelone-update-star-rule
     description: "Update an existing STAR custom detection rule by ID."
     inputs_schema:
       properties:
@@ -624,7 +624,7 @@ commands:
       required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
     outputs_schema: { properties: {} }
   - id: enable_star_rules
-    name: Enable STAR rules
+    name: sentinelone-enable-star-rules
     description: "Enable one or more STAR custom detection rules by ID."
     inputs_schema:
       properties:
@@ -632,7 +632,7 @@ commands:
       required: [rule_ids]
     outputs_schema: { properties: {} }
   - id: disable_star_rules
-    name: Disable STAR rules
+    name: sentinelone-disable-star-rules
     description: "Disable one or more STAR custom detection rules by ID."
     inputs_schema:
       properties:
@@ -640,7 +640,7 @@ commands:
       required: [rule_ids]
     outputs_schema: { properties: {} }
   - id: delete_star_rule
-    name: Delete STAR rule
+    name: sentinelone-delete-star-rule
     description: "Delete one or more STAR custom detection rules by ID."
     inputs_schema:
       properties:
@@ -648,7 +648,7 @@ commands:
       required: [rule_ids]
     outputs_schema: { properties: {} }
   - id: run_remote_script
-    name: Run remote script
+    name: sentinelone-run-remote-script
     description: "Execute a remote script (RSO) on the targeted agents."
     inputs_schema:
       properties:
@@ -664,7 +664,7 @@ commands:
       required: [account_ids, script_id, output_destination, task_description]
     outputs_schema: { properties: {} }
   - id: create_endpoint_tag
-    name: Create endpoint tag
+    name: sentinelone-create-endpoint-tag
     description: "Create an endpoint tag in the tag manager."
     inputs_schema:
       properties:
@@ -679,7 +679,7 @@ commands:
       required: [type, key]
     outputs_schema: { properties: {} }
   - id: delete_endpoint_tag
-    name: Delete endpoint tag
+    name: sentinelone-delete-endpoint-tag
     description: "Delete endpoint tags matching the given scope filter."
     inputs_schema:
       properties:
@@ -690,7 +690,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_endpoint_tags
-    name: Get endpoint tags
+    name: sentinelone-get-endpoint-tags
     description: "List endpoint tags, optionally filtered by key or value substring."
     inputs_schema:
       properties:
@@ -699,7 +699,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: create_firewall_rule
-    name: Create firewall rule
+    name: sentinelone-create-firewall-rule
     description: "Create a firewall control rule scoped to an account or site."
     inputs_schema:
       properties:
@@ -714,7 +714,7 @@ commands:
       required: [action, name, status, description, direction, filter_type, filter_id]
     outputs_schema: { properties: {} }
   - id: get_network_discovery_table
-    name: Get network discovery table
+    name: sentinelone-get-network-discovery-table
     description: "Retrieve the Ranger network discovery table view."
     inputs_schema:
       properties:
@@ -724,7 +724,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_network_discovery_assets
-    name: Get network discovery assets
+    name: sentinelone-get-network-discovery-assets
     description: "Retrieve XDR network discovery surface assets."
     inputs_schema:
       properties:
@@ -736,7 +736,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_shadow_assets
-    name: Get shadow assets
+    name: sentinelone-get-shadow-assets
     description: "Retrieve XDR shadow assets with optional coverage filters."
     inputs_schema:
       properties:
@@ -749,14 +749,14 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_gateways
-    name: Get gateways
+    name: sentinelone-get-gateways
     description: "List Ranger gateways."
     inputs_schema:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
   - id: purge_crash_dumps
-    name: Purge crash dumps
+    name: sentinelone-purge-crash-dumps
     description: "Purge agent crash dumps for the specified agents."
     inputs_schema:
       properties:
@@ -764,7 +764,7 @@ commands:
       required: [agent_ids]
     outputs_schema: { properties: {} }
   - id: list_endpoints_with_application
-    name: List endpoints with application
+    name: sentinelone-list-endpoints-with-application
     description: "List the application inventory across endpoints."
     inputs_schema:
       properties:
@@ -777,7 +777,7 @@ commands:
       required: []
     outputs_schema: { properties: {} }
   - id: get_app_inventory_endpoints
-    name: Get app inventory endpoints
+    name: sentinelone-get-app-inventory-endpoints
     description: "List endpoints that have a given application installed."
     inputs_schema:
       properties: