f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(marketplace): prefix official command names with the technology

Browse Source 
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
This commit is contained in:
Guillaume BOURGEOIS
2026-06-22 14:41:22 +02:00
parent 6b65c5f9df
commit e3e363c2f9
2 changed files with 145 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/harfanglab/manifest.yaml
+73 -73
View File
@@ -1,8 +1,8 @@
id: harfanglab
name: HarfangLab EDR
version: 1.0.0
version: 1.1.0
description: "HarfangLab EDR — endpoint detection & response: endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
changelog: "1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
category: endpoint
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
@@ -32,7 +32,7 @@ auth:
commands:
# ── Endpoints / agents ────────────────────────────────────────────────────
- id: get_endpoint_info
name: Get endpoint info
name: harfanglab-get-endpoint-info
description: Get endpoint (agent) information by agent ID.
inputs_schema:
properties:
@@ -40,7 +40,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: endpoint_search
name: Endpoint search
name: harfanglab-endpoint-search
description: Search endpoints (agents) by hostname.
inputs_schema:
properties:
@@ -48,7 +48,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: isolate_endpoint
name: Isolate endpoint
name: harfanglab-isolate-endpoint
description: Network-isolate an endpoint (agent) by agent ID.
inputs_schema:
properties:
@@ -56,7 +56,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: deisolate_endpoint
name: Deisolate endpoint
name: harfanglab-deisolate-endpoint
description: Remove network isolation from an endpoint (agent) by agent ID.
inputs_schema:
properties:
@@ -64,7 +64,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: assign_policy_to_agent
name: Assign policy to agent
name: harfanglab-assign-policy-to-agent
description: Assign a security policy to an agent by policy name and agent ID.
inputs_schema:
properties:
@@ -75,7 +75,7 @@ commands:
# ── Threat intelligence: whitelists ───────────────────────────────────────
- id: whitelist_search
name: Search whitelists
name: harfanglab-whitelist-search
description: Search threat-intelligence whitelists by keyword.
inputs_schema:
properties:
@@ -84,7 +84,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: whitelist_add
name: Add whitelist
name: harfanglab-whitelist-add
description: Create a threat-intelligence whitelist rule with an initial criterion.
inputs_schema:
properties:
@@ -98,7 +98,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: whitelist_add_criterion
name: Add whitelist criterion
name: harfanglab-whitelist-add-criterion
description: Append a criterion to an existing whitelist rule.
inputs_schema:
properties:
@@ -110,7 +110,7 @@ commands:
required: [id]
outputs_schema: { properties: {} }
- id: whitelist_delete
name: Delete whitelist
name: harfanglab-whitelist-delete
description: Delete a threat-intelligence whitelist rule by id.
inputs_schema:
properties:
@@ -120,7 +120,7 @@ commands:
# ── Threat intelligence: IOCs ─────────────────────────────────────────────
- id: add_ioc_to_source
name: Add IOC to source
name: harfanglab-add-ioc-to-source
description: Add an IOC to a named IOC source if it does not already exist.
inputs_schema:
properties:
@@ -132,7 +132,7 @@ commands:
required: [ioc_value, ioc_type, ioc_status, source_name]
outputs_schema: { properties: {} }
- id: delete_ioc_from_source
name: Delete IOC from source
name: harfanglab-delete-ioc-from-source
description: Remove an IOC from a named IOC source if it exists.
inputs_schema:
properties:
@@ -143,7 +143,7 @@ commands:
# ── Security events ───────────────────────────────────────────────────────
- id: change_security_event_status
name: Change security event status
name: harfanglab-change-security-event-status
description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
inputs_schema:
properties:
@@ -154,7 +154,7 @@ commands:
# ── Generic / utility ─────────────────────────────────────────────────────
- id: api_call
name: API call
name: harfanglab-api-call
description: "Perform a generic authenticated call to the HarfangLab API."
inputs_schema:
properties:
@@ -165,7 +165,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_process_graph
name: Telemetry process graph
name: harfanglab-telemetry-process-graph
description: "Retrieve the process graph for a telemetry process UUID."
inputs_schema:
properties:
@@ -175,7 +175,7 @@ commands:
# ── Threat hunting by hash ────────────────────────────────────────────────
- id: hunt_search_hash
name: Hunt search hash
name: harfanglab-hunt-search-hash
description: "Search the data explorer for a file hash."
inputs_schema:
properties:
@@ -183,7 +183,7 @@ commands:
required: [hash]
outputs_schema: { properties: {} }
- id: hunt_search_running_process_hash
name: Hunt search running process by hash
name: harfanglab-hunt-search-running-process-hash
description: "Hunt for currently running processes matching a SHA-256 hash."
inputs_schema:
properties:
@@ -191,7 +191,7 @@ commands:
required: [hash]
outputs_schema: { properties: {} }
- id: hunt_search_runned_process_hash
name: Hunt search runned process by hash
name: harfanglab-hunt-search-runned-process-hash
description: "Search process telemetry for executions matching a SHA-256 hash."
inputs_schema:
properties:
@@ -201,7 +201,7 @@ commands:
# ── Telemetry ─────────────────────────────────────────────────────────────
- id: telemetry_processes
name: Telemetry — processes
name: harfanglab-telemetry-processes
description: Search process telemetry.
inputs_schema:
properties:
@@ -213,7 +213,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_dns
name: Telemetry — DNS resolution
name: harfanglab-telemetry-dns
description: Search DNS resolution telemetry.
inputs_schema:
properties:
@@ -226,7 +226,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_network
name: Telemetry — network
name: harfanglab-telemetry-network
description: Search network connection telemetry.
inputs_schema:
properties:
@@ -241,7 +241,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_eventlog
name: Telemetry — event log
name: harfanglab-telemetry-eventlog
description: Search Windows full event log telemetry.
inputs_schema:
properties:
@@ -253,7 +253,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_binary
name: Telemetry — binary
name: harfanglab-telemetry-binary
description: Search binary telemetry.
inputs_schema:
properties:
@@ -264,7 +264,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_windows
name: Telemetry — Windows authentication
name: harfanglab-telemetry-authentication-windows
description: Search Windows authentication telemetry.
inputs_schema:
properties:
@@ -281,7 +281,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_linux
name: Telemetry — Linux authentication
name: harfanglab-telemetry-authentication-linux
description: Search Linux authentication telemetry.
inputs_schema:
properties:
@@ -296,7 +296,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_macos
name: Telemetry — macOS authentication
name: harfanglab-telemetry-authentication-macos
description: Search macOS authentication telemetry.
inputs_schema:
properties:
@@ -311,7 +311,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_users
name: Telemetry — top authenticating users
name: harfanglab-telemetry-authentication-users
description: Rank users by authentication attempts across Windows, Linux and macOS.
inputs_schema:
properties:
@@ -324,7 +324,7 @@ commands:
# ── Collection jobs ───────────────────────────────────────────────────────
- id: job_pipelist
name: Job — list pipes
name: harfanglab-job-pipelist
description: Start a job to list named pipes on a host (Windows).
inputs_schema:
properties:
@@ -332,7 +332,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_prefetchlist
name: Job — list prefetch
name: harfanglab-job-prefetchlist
description: Start a job to collect Windows prefetch files on a host.
inputs_schema:
properties:
@@ -340,7 +340,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_runkeylist
name: Job — list run keys
name: harfanglab-job-runkeylist
description: Start a job to collect registry run keys (hives) on a host.
inputs_schema:
properties:
@@ -348,7 +348,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_scheduledtasklist
name: Job — list scheduled tasks
name: harfanglab-job-scheduledtasklist
description: Start a job to list scheduled tasks on a host.
inputs_schema:
properties:
@@ -356,7 +356,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_driverlist
name: Job — list drivers
name: harfanglab-job-driverlist
description: Start a job to list loaded drivers on a host.
inputs_schema:
properties:
@@ -364,7 +364,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_servicelist
name: Job — list services
name: harfanglab-job-servicelist
description: Start a job to collect services from registry hives on a host.
inputs_schema:
properties:
@@ -372,7 +372,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_processlist
name: Job — list processes
name: harfanglab-job-processlist
description: Start a job to list running processes with signature info on a host.
inputs_schema:
properties:
@@ -380,7 +380,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_networkconnectionlist
name: Job — list network connections
name: harfanglab-job-networkconnectionlist
description: Start a job to list processes with their active network connections on a host.
inputs_schema:
properties:
@@ -388,7 +388,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_networksharelist
name: Job — list network shares
name: harfanglab-job-networksharelist
description: Start a job to list network shares on a host.
inputs_schema:
properties:
@@ -396,7 +396,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_sessionlist
name: Job — list sessions
name: harfanglab-job-sessionlist
description: Start a job to list active user sessions on a host.
inputs_schema:
properties:
@@ -404,7 +404,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_persistencelist
name: Job — list persistence
name: harfanglab-job-persistencelist
description: Start a job to scan for persistence mechanisms on a host.
inputs_schema:
properties:
@@ -412,7 +412,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_startuplist
name: Job — list startup files
name: harfanglab-job-startuplist
description: Start a job to list startup files on a host.
inputs_schema:
properties:
@@ -420,7 +420,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_wmilist
name: Job — list WMI
name: harfanglab-job-wmilist
description: Start a job to collect WMI persistence artifacts on a host.
inputs_schema:
properties:
@@ -428,7 +428,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_ioc
name: Job — IOC scan
name: harfanglab-job-ioc
description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
inputs_schema:
properties:
@@ -444,7 +444,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_info
name: Job — get job info
name: harfanglab-job-info
description: Retrieve information for one or more jobs by their identifiers.
inputs_schema:
properties:
@@ -454,7 +454,7 @@ commands:
# ── Forensic artifact collection jobs ─────────────────────────────────────
- id: job_artifact_mft
name: Job — collect MFT
name: harfanglab-job-artifact-mft
description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
inputs_schema:
properties:
@@ -462,7 +462,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_hives
name: Job — collect registry hives
name: harfanglab-job-artifact-hives
description: Start a job to collect the Windows registry hives from a host.
inputs_schema:
properties:
@@ -470,7 +470,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_evtx
name: Job — collect event logs
name: harfanglab-job-artifact-evtx
description: Start a job to collect the Windows event logs (EVTX) from a host.
inputs_schema:
properties:
@@ -478,7 +478,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_logs
name: Job — collect system logs
name: harfanglab-job-artifact-logs
description: Start a job to collect the system logs from a host.
inputs_schema:
properties:
@@ -486,7 +486,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_filesystem
name: Job — collect filesystem listing
name: harfanglab-job-artifact-filesystem
description: Start a job to collect the filesystem listing from a host.
inputs_schema:
properties:
@@ -494,7 +494,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_all
name: Job — collect all raw evidence
name: harfanglab-job-artifact-all
description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
inputs_schema:
properties:
@@ -502,7 +502,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_ramdump
name: Job — dump RAM
name: harfanglab-job-artifact-ramdump
description: Start a job to capture a full memory (RAM) dump from a host.
inputs_schema:
properties:
@@ -510,7 +510,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_downloadfile
name: Job — download file
name: harfanglab-job-artifact-downloadfile
description: Start a job to download a specific file from a host by its full path.
inputs_schema:
properties:
@@ -521,7 +521,7 @@ commands:
# ── Job results (hunting) ─────────────────────────────────────────────────
- id: result_pipelist
name: Result — pipes
name: harfanglab-result-pipelist
description: Get a host's list of named pipes from a job result.
inputs_schema:
properties:
@@ -529,7 +529,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_prefetchlist
name: Result — prefetch
name: harfanglab-result-prefetchlist
description: Get a host's prefetch entries from a job result.
inputs_schema:
properties:
@@ -537,7 +537,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_runkeylist
name: Result — run keys
name: harfanglab-result-runkeylist
description: Get a host's registry run keys from a job result.
inputs_schema:
properties:
@@ -545,7 +545,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_scheduledtasklist
name: Result — scheduled tasks
name: harfanglab-result-scheduledtasklist
description: Get a host's scheduled tasks from a job result.
inputs_schema:
properties:
@@ -553,7 +553,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_driverlist
name: Result — drivers
name: harfanglab-result-driverlist
description: Get a host's list of drivers from a job result.
inputs_schema:
properties:
@@ -561,7 +561,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_servicelist
name: Result — services
name: harfanglab-result-servicelist
description: Get a host's list of services from a job result.
inputs_schema:
properties:
@@ -569,7 +569,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_processlist
name: Result — processes
name: harfanglab-result-processlist
description: Get a host's list of running processes from a job result.
inputs_schema:
properties:
@@ -577,7 +577,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_networkconnectionlist
name: Result — network connections
name: harfanglab-result-networkconnectionlist
description: Get a host's network connections from a job result.
inputs_schema:
properties:
@@ -585,7 +585,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_networksharelist
name: Result — network shares
name: harfanglab-result-networksharelist
description: Get a host's list of network shares from a job result.
inputs_schema:
properties:
@@ -593,7 +593,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_sessionlist
name: Result — sessions
name: harfanglab-result-sessionlist
description: Get a host's list of user sessions from a job result.
inputs_schema:
properties:
@@ -601,7 +601,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_persistencelist
name: Result — persistence
name: harfanglab-result-persistencelist
description: Get a host's persistence files from a job result.
inputs_schema:
properties:
@@ -609,7 +609,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_startuplist
name: Result — startup items
name: harfanglab-result-startuplist
description: Get a host's startup items from a job result.
inputs_schema:
properties:
@@ -617,7 +617,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_wmilist
name: Result — WMI
name: harfanglab-result-wmilist
description: Get a host's WMI persistence entries from a job result.
inputs_schema:
properties:
@@ -625,7 +625,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_ioc
name: Result — IOC matches
name: harfanglab-result-ioc
description: Get a host's IOC matches from a job result.
inputs_schema:
properties:
@@ -635,7 +635,7 @@ commands:
# ── Job results (forensic artifacts) ──────────────────────────────────────
- id: result_artifact_mft
name: Result — MFT artifact
name: harfanglab-result-artifact-mft
description: Get the MFT download links from a collection job result.
inputs_schema:
properties:
@@ -643,7 +643,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_hives
name: Result — Registry hives artifact
name: harfanglab-result-artifact-hives
description: Get the Windows registry hive download links from a collection job result.
inputs_schema:
properties:
@@ -651,7 +651,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_evtx
name: Result — EVTX artifact
name: harfanglab-result-artifact-evtx
description: Get the Windows event log (EVTX) download links from a collection job result.
inputs_schema:
properties:
@@ -659,7 +659,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_logs
name: Result — Linux logs artifact
name: harfanglab-result-artifact-logs
description: Get the Linux system log download links from a collection job result.
inputs_schema:
properties:
@@ -667,7 +667,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_filesystem
name: Result — Filesystem artifact
name: harfanglab-result-artifact-filesystem
description: Get the filesystem listing download links from a collection job result.
inputs_schema:
properties:
@@ -675,7 +675,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_all
name: Result — All artifacts
name: harfanglab-result-artifact-all
description: Get the download links for all collected artifacts from a collection job result.
inputs_schema:
properties:
@@ -683,7 +683,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_downloadfile
name: Result — Downloaded file artifact
name: harfanglab-result-artifact-downloadfile
description: Get the download link for a file retrieved by a download-file job result.
inputs_schema:
properties:
@@ -691,7 +691,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_ramdump
name: Result — RAM dump artifact
name: harfanglab-result-artifact-ramdump
description: Get the memory (RAM) dump download links from a collection job result.
inputs_schema:
properties:
integrations/sentinelone/manifest.yaml
+72 -72
View File
@@ -1,8 +1,8 @@
id: sentinelone
name: SentinelOne
version: 1.0.0
version: 1.1.0
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
changelog: "1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
changelog: "1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
category: endpoint
# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
@@ -32,7 +32,7 @@ auth:
commands:
# ── Enrichment / read ─────────────────────────────────────────────────────
- id: get_threats
name: Get threats
name: sentinelone-get-threats
description: List threats/detections matching filters.
inputs_schema:
properties:
@@ -45,7 +45,7 @@ commands:
outputs_schema: { properties: {} }
- id: list_agents
name: List agents
name: sentinelone-list-agents
description: List endpoints (agents) matching filters.
inputs_schema:
properties:
@@ -57,7 +57,7 @@ commands:
outputs_schema: { properties: {} }
- id: get_agent
name: Get agent
name: sentinelone-get-agent
description: Get details for one or more agents by ID.
inputs_schema:
properties:
@@ -66,7 +66,7 @@ commands:
outputs_schema: { properties: {} }
- id: get_hash_verdict
name: Get hash verdict
name: sentinelone-get-hash-verdict
description: Reputation verdict for a SHA1 hash.
inputs_schema:
properties:
@@ -76,7 +76,7 @@ commands:
# ── Response ──────────────────────────────────────────────────────────────
- id: isolate_agent
name: Isolate agent (disconnect)
name: sentinelone-isolate-agent
description: Disconnect agents from the network.
inputs_schema:
properties:
@@ -85,7 +85,7 @@ commands:
outputs_schema: { properties: {} }
- id: reconnect_agent
name: Reconnect agent
name: sentinelone-reconnect-agent
description: Reconnect agents to the network.
inputs_schema:
properties:
@@ -94,7 +94,7 @@ commands:
outputs_schema: { properties: {} }
- id: mitigate_threat
name: Mitigate threat
name: sentinelone-mitigate-threat
description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
inputs_schema:
properties:
@@ -104,7 +104,7 @@ commands:
outputs_schema: { properties: {} }
- id: initiate_scan
name: Initiate endpoint scan
name: sentinelone-initiate-scan
description: Start a full disk scan on agents.
inputs_schema:
properties:
@@ -113,7 +113,7 @@ commands:
outputs_schema: { properties: {} }
- id: write_threat_note
name: Add threat note
name: sentinelone-write-threat-note
description: Add a note to one or more threats.
inputs_schema:
properties:
@@ -124,7 +124,7 @@ commands:
# ── Agents: actions & info ────────────────────────────────────────────────
- id: shutdown_agent
name: Shutdown agent
name: sentinelone-shutdown-agent
description: "Send a shutdown command to agents matching the filter."
inputs_schema:
properties:
@@ -134,7 +134,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: uninstall_agent
name: Uninstall agent
name: sentinelone-uninstall-agent
description: "Send an uninstall command to agents matching the filter."
inputs_schema:
properties:
@@ -144,7 +144,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: broadcast_message
name: Broadcast message
name: sentinelone-broadcast-message
description: "Broadcast a message to agents matching the filter."
inputs_schema:
properties:
@@ -155,7 +155,7 @@ commands:
required: [message]
outputs_schema: { properties: {} }
- id: enable_agent
name: Enable agent
name: sentinelone-enable-agent
description: "Enable agents matching the given IDs, optionally rebooting them."
inputs_schema:
properties:
@@ -164,7 +164,7 @@ commands:
required: [agent_ids]
outputs_schema: { properties: {} }
- id: move_agent
name: Move agent
name: sentinelone-move-agent
description: "Move agents into the specified group."
inputs_schema:
properties:
@@ -173,7 +173,7 @@ commands:
required: [group_id, agents_ids]
outputs_schema: { properties: {} }
- id: count_agents
name: Count agents
name: sentinelone-count-agents
description: "Count agents matching the given filters."
inputs_schema:
properties:
@@ -185,7 +185,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_agent_mac
name: Get agent MAC addresses
name: sentinelone-get-agent-mac
description: "Retrieve network interfaces (IP and MAC) for a single agent."
inputs_schema:
properties:
@@ -193,7 +193,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: get_installed_applications
name: Get installed applications
name: sentinelone-get-installed-applications
description: "Retrieve the applications installed on the given agents."
inputs_schema:
properties:
@@ -201,7 +201,7 @@ commands:
required: [agent_ids]
outputs_schema: { properties: {} }
- id: manage_tags
name: Manage tags
name: sentinelone-manage-tags
description: "Add, override or remove a tag on the given agents."
inputs_schema:
properties:
@@ -213,7 +213,7 @@ commands:
# ── Threats & Alerts ──────────────────────────────────────────────────────
- id: resolve_threat
name: Resolve threat
name: sentinelone-resolve-threat
description: "Mark one or more threats as resolved."
inputs_schema:
properties:
@@ -221,7 +221,7 @@ commands:
required: [threat_ids]
outputs_schema: { properties: {} }
- id: mark_as_threat
name: Mark as threat
name: sentinelone-mark-as-threat
description: "Mark detections as a true threat, scoped to a site or the whole tenant."
inputs_schema:
properties:
@@ -230,7 +230,7 @@ commands:
required: [threat_ids, target_scope]
outputs_schema: { properties: {} }
- id: update_threats_verdict
name: Update threats verdict
name: sentinelone-update-threats-verdict
description: "Set the analyst verdict on one or more threats."
inputs_schema:
properties:
@@ -239,7 +239,7 @@ commands:
required: [verdict, threat_ids]
outputs_schema: { properties: {} }
- id: update_threats_status
name: Update threats status
name: sentinelone-update-threats-status
description: "Set the incident status on one or more threats."
inputs_schema:
properties:
@@ -248,7 +248,7 @@ commands:
required: [status, threat_ids]
outputs_schema: { properties: {} }
- id: get_threat_notes
name: Get threat notes
name: sentinelone-get-threat-notes
description: "Retrieve the notes attached to a single threat."
inputs_schema:
properties:
@@ -256,7 +256,7 @@ commands:
required: [threat_id]
outputs_schema: { properties: {} }
- id: get_threat_summary
name: Get threat summary
name: sentinelone-get-threat-summary
description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
inputs_schema:
properties:
@@ -265,7 +265,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: fetch_threat_file
name: Fetch threat file
name: sentinelone-fetch-threat-file
description: "Request the threat file for download, protected by a ZIP password."
inputs_schema:
properties:
@@ -274,7 +274,7 @@ commands:
required: [threat_id, password]
outputs_schema: { properties: {} }
- id: get_alerts
name: Get alerts
name: sentinelone-get-alerts
description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
inputs_schema:
properties:
@@ -289,7 +289,7 @@ commands:
required: [created_from]
outputs_schema: { properties: {} }
- id: update_alerts_verdict
name: Update alerts verdict
name: sentinelone-update-alerts-verdict
description: "Set the analyst verdict on one or more cloud-detection alerts."
inputs_schema:
properties:
@@ -298,7 +298,7 @@ commands:
required: [verdict, alert_ids]
outputs_schema: { properties: {} }
- id: update_alerts_status
name: Update alerts status
name: sentinelone-update-alerts-status
description: "Set the incident status on one or more cloud-detection alerts."
inputs_schema:
properties:
@@ -309,7 +309,7 @@ commands:
# ── Hash, blocklist, exclusions, IOCs ─────────────────────────────────────
- id: get_blocklist
name: Get blocklist
name: sentinelone-get-blocklist
description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
inputs_schema:
properties:
@@ -323,7 +323,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: add_hash_to_blocklist
name: Add hash to blocklist
name: sentinelone-add-hash-to-blocklist
description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
inputs_schema:
properties:
@@ -338,7 +338,7 @@ commands:
required: [os_type]
outputs_schema: { properties: {} }
- id: remove_hash_from_blocklist
name: Remove hash from blocklist
name: sentinelone-remove-hash-from-blocklist
description: "Find blocklist entries matching a SHA1 hash and delete them."
inputs_schema:
properties:
@@ -347,7 +347,7 @@ commands:
required: [sha1]
outputs_schema: { properties: {} }
- id: get_white_list
name: Get exclusions (white list)
name: sentinelone-get-white-list
description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
inputs_schema:
properties:
@@ -361,7 +361,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: create_white_list_item
name: Create exclusion item
name: sentinelone-create-white-list-item
description: "Create an exclusion (whitelist) item of the given type and value."
inputs_schema:
properties:
@@ -376,7 +376,7 @@ commands:
required: [exclusion_type, exclusion_value, os_type]
outputs_schema: { properties: {} }
- id: remove_item_from_whitelist
name: Remove exclusion item
name: sentinelone-remove-item-from-whitelist
description: "Find exclusion items matching a value and delete them."
inputs_schema:
properties:
@@ -386,7 +386,7 @@ commands:
required: [item]
outputs_schema: { properties: {} }
- id: delete_exclusion
name: Delete exclusion
name: sentinelone-delete-exclusion
description: "Delete exclusion items by their IDs and type."
inputs_schema:
properties:
@@ -395,7 +395,7 @@ commands:
required: [ids, type]
outputs_schema: { properties: {} }
- id: create_ioc
name: Create IOC
name: sentinelone-create-ioc
description: "Create a threat-intelligence IOC for the given account scope."
inputs_schema:
properties:
@@ -411,7 +411,7 @@ commands:
required: [name, source, type, method, validUntil, value, account_ids]
outputs_schema: { properties: {} }
- id: delete_ioc
name: Delete IOC
name: sentinelone-delete-ioc
description: "Delete threat-intelligence IOCs by UUID within the given account scope."
inputs_schema:
properties:
@@ -420,7 +420,7 @@ commands:
required: [account_ids, uuids]
outputs_schema: { properties: {} }
- id: get_iocs
name: Get IOCs
name: sentinelone-get-iocs
description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
inputs_schema:
properties:
@@ -435,7 +435,7 @@ commands:
# ── Sites, groups, accounts, users, Deep Visibility ───────────────────────
- id: get_activities
name: Get activities
name: sentinelone-get-activities
description: "Retrieve activities, optionally filtered by date, agents, or threats."
inputs_schema:
properties:
@@ -446,7 +446,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_groups
name: Get groups
name: sentinelone-get-groups
description: "List groups with optional filters."
inputs_schema:
properties:
@@ -459,7 +459,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: delete_group
name: Delete group
name: sentinelone-delete-group
description: "Delete a group by its ID."
inputs_schema:
properties:
@@ -467,7 +467,7 @@ commands:
required: [group_id]
outputs_schema: { properties: {} }
- id: get_sites
name: Get sites
name: sentinelone-get-sites
description: "List sites with optional filters."
inputs_schema:
properties:
@@ -480,7 +480,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_site
name: Get site
name: sentinelone-get-site
description: "Retrieve a single site by its ID."
inputs_schema:
properties:
@@ -488,7 +488,7 @@ commands:
required: [site_id]
outputs_schema: { properties: {} }
- id: reactivate_site
name: Reactivate site
name: sentinelone-reactivate-site
description: "Reactivate an expired site."
inputs_schema:
properties:
@@ -498,7 +498,7 @@ commands:
required: [site_id]
outputs_schema: { properties: {} }
- id: expire_site
name: Expire site
name: sentinelone-expire-site
description: "Expire a site immediately."
inputs_schema:
properties:
@@ -506,7 +506,7 @@ commands:
required: [site_id]
outputs_schema: { properties: {} }
- id: get_accounts
name: Get accounts
name: sentinelone-get-accounts
description: "List all accounts, or retrieve a single account when an ID is provided."
inputs_schema:
properties:
@@ -514,7 +514,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: list_users
name: List users
name: sentinelone-list-users
description: "List users, optionally filtered by account IDs."
inputs_schema:
properties:
@@ -523,7 +523,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: delete_user
name: Delete user
name: sentinelone-delete-user
description: "Delete a user by their ID."
inputs_schema:
properties:
@@ -531,7 +531,7 @@ commands:
required: [user_id]
outputs_schema: { properties: {} }
- id: create_query
name: Create DV query
name: sentinelone-create-query
description: "Initialize a Deep Visibility query over a given time range."
inputs_schema:
properties:
@@ -541,7 +541,7 @@ commands:
required: [query, from_date, to_date]
outputs_schema: { properties: {} }
- id: get_dv_query_status
name: Get DV query status
name: sentinelone-get-dv-query-status
description: "Get the status of a Deep Visibility query by ID."
inputs_schema:
properties:
@@ -549,7 +549,7 @@ commands:
required: [query_id]
outputs_schema: { properties: {} }
- id: get_events
name: Get DV events
name: sentinelone-get-events
description: "Retrieve events for a completed Deep Visibility query."
inputs_schema:
properties:
@@ -559,7 +559,7 @@ commands:
required: [query_id]
outputs_schema: { properties: {} }
- id: get_processes
name: Get DV processes
name: sentinelone-get-processes
description: "Retrieve process events for a completed Deep Visibility query."
inputs_schema:
properties:
@@ -570,7 +570,7 @@ commands:
# ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ──────
- id: create_star_rule
name: Create STAR rule
name: sentinelone-create-star-rule
description: "Create a STAR custom detection rule in Draft status."
inputs_schema:
properties:
@@ -589,7 +589,7 @@ commands:
required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
outputs_schema: { properties: {} }
- id: get_star_rules
name: Get STAR rules
name: sentinelone-get-star-rules
description: "List STAR custom detection rules."
inputs_schema:
properties:
@@ -603,7 +603,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: update_star_rule
name: Update STAR rule
name: sentinelone-update-star-rule
description: "Update an existing STAR custom detection rule by ID."
inputs_schema:
properties:
@@ -624,7 +624,7 @@ commands:
required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
outputs_schema: { properties: {} }
- id: enable_star_rules
name: Enable STAR rules
name: sentinelone-enable-star-rules
description: "Enable one or more STAR custom detection rules by ID."
inputs_schema:
properties:
@@ -632,7 +632,7 @@ commands:
required: [rule_ids]
outputs_schema: { properties: {} }
- id: disable_star_rules
name: Disable STAR rules
name: sentinelone-disable-star-rules
description: "Disable one or more STAR custom detection rules by ID."
inputs_schema:
properties:
@@ -640,7 +640,7 @@ commands:
required: [rule_ids]
outputs_schema: { properties: {} }
- id: delete_star_rule
name: Delete STAR rule
name: sentinelone-delete-star-rule
description: "Delete one or more STAR custom detection rules by ID."
inputs_schema:
properties:
@@ -648,7 +648,7 @@ commands:
required: [rule_ids]
outputs_schema: { properties: {} }
- id: run_remote_script
name: Run remote script
name: sentinelone-run-remote-script
description: "Execute a remote script (RSO) on the targeted agents."
inputs_schema:
properties:
@@ -664,7 +664,7 @@ commands:
required: [account_ids, script_id, output_destination, task_description]
outputs_schema: { properties: {} }
- id: create_endpoint_tag
name: Create endpoint tag
name: sentinelone-create-endpoint-tag
description: "Create an endpoint tag in the tag manager."
inputs_schema:
properties:
@@ -679,7 +679,7 @@ commands:
required: [type, key]
outputs_schema: { properties: {} }
- id: delete_endpoint_tag
name: Delete endpoint tag
name: sentinelone-delete-endpoint-tag
description: "Delete endpoint tags matching the given scope filter."
inputs_schema:
properties:
@@ -690,7 +690,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_endpoint_tags
name: Get endpoint tags
name: sentinelone-get-endpoint-tags
description: "List endpoint tags, optionally filtered by key or value substring."
inputs_schema:
properties:
@@ -699,7 +699,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: create_firewall_rule
name: Create firewall rule
name: sentinelone-create-firewall-rule
description: "Create a firewall control rule scoped to an account or site."
inputs_schema:
properties:
@@ -714,7 +714,7 @@ commands:
required: [action, name, status, description, direction, filter_type, filter_id]
outputs_schema: { properties: {} }
- id: get_network_discovery_table
name: Get network discovery table
name: sentinelone-get-network-discovery-table
description: "Retrieve the Ranger network discovery table view."
inputs_schema:
properties:
@@ -724,7 +724,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_network_discovery_assets
name: Get network discovery assets
name: sentinelone-get-network-discovery-assets
description: "Retrieve XDR network discovery surface assets."
inputs_schema:
properties:
@@ -736,7 +736,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_shadow_assets
name: Get shadow assets
name: sentinelone-get-shadow-assets
description: "Retrieve XDR shadow assets with optional coverage filters."
inputs_schema:
properties:
@@ -749,14 +749,14 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_gateways
name: Get gateways
name: sentinelone-get-gateways
description: "List Ranger gateways."
inputs_schema:
properties: {}
required: []
outputs_schema: { properties: {} }
- id: purge_crash_dumps
name: Purge crash dumps
name: sentinelone-purge-crash-dumps
description: "Purge agent crash dumps for the specified agents."
inputs_schema:
properties:
@@ -764,7 +764,7 @@ commands:
required: [agent_ids]
outputs_schema: { properties: {} }
- id: list_endpoints_with_application
name: List endpoints with application
name: sentinelone-list-endpoints-with-application
description: "List the application inventory across endpoints."
inputs_schema:
properties:
@@ -777,7 +777,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: get_app_inventory_endpoints
name: Get app inventory endpoints
name: sentinelone-get-app-inventory-endpoints
description: "List endpoints that have a given application installed."
inputs_schema:
properties: