3 Commits

Author	SHA1	Message	Date
f3nris	c67343b7cf	feat(sentinelone): instance-level account scope (1.20.0) ... An instance can carry the account IDs of the client it serves, for clients sharing one multi-tenant console. count_agents, get_threats, get_alerts and get_unified_alerts use them when the block leaves its account filter empty; an account named on the block still wins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TgjV26rz6VcP262dX4vBrD	2026-10-19 19:08:10 +00:00
Guillaume BOURGEOIS	7efc873867	feat(sentinelone): scope threat and alert fetches to given accounts (v1.4.0) ... A multi-tenant console returns every account's threats and alerts at once. get_threats and get_alerts now take an optional account_ids input, passed through as the accountIds query parameter, so an ingestion can be pinned to the accounts the SOC actually watches. The input is optional, so existing instances and running ingestions keep their current behaviour. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 15:56:47 +02:00
f3nris	a3ac1ee30d	feat(sentinelone): curated EDR integration (9 analyst commands, API v2.1) ... Endpoints derived from the SentinelOne API v2.1. Script-based (urllib, INTEGRATION_SECRETS/INPUTS contract) to express S1's nested filter bodies. Config: console url + api_token (ApiToken header). Commands: - enrich: get_threats, list_agents, get_agent, get_hash_verdict - respond: isolate_agent (disconnect), reconnect_agent (connect), mitigate_threat (kill/quarantine/remediate/rollback), initiate_scan, write_threat_note	2026-06-22 12:31:45 +02:00