2 Commits

Author	SHA1	Message	Date
Claude	91855fce4f	fix(sentinelone): count the host's other alerts from what was read (1.19.1) ... A real run answered one other alert and named none: the count came from the console's total minus the alert itself, and that total did not hold the alert. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ	2026-10-12 11:37:19 +00:00
Claude	6f51520fb5	feat(sentinelone): investigate_alert, one call for an agent (1.19.0) ... Wraith spent ten calls on a real unified alert and still lost the host: it took the UAM asset id for an agent id and the raw agent list ran past what a tool result carries. investigate_alert reads the alert, its detail, the host's agent (by id or UUID, then name), the other alerts and threats on that host around the detection, and the file SHA1's reputation, blocklist and fleet-wide threats, summarised in one answer. The operator sheet now starts with it (budget 8). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ	2026-10-12 11:27:36 +00:00