2 Commits

Author	SHA1	Message	Date
Guillaume BOURGEOIS	7efc873867	feat(sentinelone): scope threat and alert fetches to given accounts (v1.4.0) ... A multi-tenant console returns every account's threats and alerts at once. get_threats and get_alerts now take an optional account_ids input, passed through as the accountIds query parameter, so an ingestion can be pinned to the accounts the SOC actually watches. The input is optional, so existing instances and running ingestions keep their current behaviour. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 15:56:47 +02:00
f3nris	a3ac1ee30d	feat(sentinelone): curated EDR integration (9 analyst commands, API v2.1) ... Endpoints derived from the SentinelOne API v2.1. Script-based (urllib, INTEGRATION_SECRETS/INPUTS contract) to express S1's nested filter bodies. Config: console url + api_token (ApiToken header). Commands: - enrich: get_threats, list_agents, get_agent, get_hash_verdict - respond: isolate_agent (disconnect), reconnect_agent (connect), mitigate_threat (kill/quarantine/remediate/rollback), initiate_scan, write_threat_note	2026-06-22 12:31:45 +02:00