id: sentinelone
name: SentinelOne
version: 1.0.0
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
changelog: "1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
category: endpoint

# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
config_schema:
  properties:
    url:
      type: string
      description: SentinelOne console URL, e.g. https://usea1.sentinelone.net
    api_token:
      type: string
      description: API token (console → My User → API Token)
      x-soar-sensitive: true
  required:
    - url
    - api_token

# Documented for reference; the bundled scripts build the header themselves
# (Authorization: ApiToken <token>).
auth:
  - id: apitoken
    type: api_key
    in: header
    name: Authorization
    value_template: "ApiToken {{secret}}"
    secret_field: api_token

commands:
  # ── Enrichment / read ─────────────────────────────────────────────────────
  - id: get_threats
    name: Get threats
    description: List threats/detections matching filters.
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 20)" }
        mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" }
        query: { type: string, description: "Free-text (hash, file, computer name, uuid)" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
      required: []
    outputs_schema: { properties: {} }

  - id: list_agents
    name: List agents
    description: List endpoints (agents) matching filters.
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Substring match on computer name" }
        os_type: { type: string, description: "windows | macos | linux" }
        is_active: { type: boolean, description: "Only active agents" }
        limit: { type: number, description: "Max results (default 50)" }
      required: []
    outputs_schema: { properties: {} }

  - id: get_agent
    name: Get agent
    description: Get details for one or more agents by ID.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: get_hash_verdict
    name: Get hash verdict
    description: Reputation verdict for a SHA1 hash.
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA1 hash" }
      required: [hash]
    outputs_schema: { properties: {} }

  # ── Response ──────────────────────────────────────────────────────────────
  - id: isolate_agent
    name: Isolate agent (disconnect)
    description: Disconnect agents from the network.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: reconnect_agent
    name: Reconnect agent
    description: Reconnect agents to the network.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: mitigate_threat
    name: Mitigate threat
    description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
    inputs_schema:
      properties:
        action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
      required: [action, threat_ids]
    outputs_schema: { properties: {} }

  - id: initiate_scan
    name: Initiate endpoint scan
    description: Start a full disk scan on agents.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: write_threat_note
    name: Add threat note
    description: Add a note to one or more threats.
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        note: { type: string, description: "Note text" }
      required: [threat_ids, note]
    outputs_schema: { properties: {} }

  # ── Agents: actions & info ────────────────────────────────────────────────
  - id: shutdown_agent
    name: Shutdown agent
    description: "Send a shutdown command to agents matching the filter."
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        query: { type: string, description: "Free-text agent match" }
      required: []
    outputs_schema: { properties: {} }
  - id: uninstall_agent
    name: Uninstall agent
    description: "Send an uninstall command to agents matching the filter."
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        query: { type: string, description: "Free-text agent match" }
      required: []
    outputs_schema: { properties: {} }
  - id: broadcast_message
    name: Broadcast message
    description: "Broadcast a message to agents matching the filter."
    inputs_schema:
      properties:
        message: { type: string, description: "Message to broadcast to agents" }
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        active_agent: { type: boolean, description: "Only target active agents" }
      required: [message]
    outputs_schema: { properties: {} }
  - id: enable_agent
    name: Enable agent
    description: "Enable agents matching the given IDs, optionally rebooting them."
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
        shouldReboot: { type: boolean, description: "Reboot agents after enabling" }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: move_agent
    name: Move agent
    description: "Move agents into the specified group."
    inputs_schema:
      properties:
        group_id: { type: string, description: "Target group ID" }
        agents_ids: { type: string, description: "Comma-separated agent IDs to move" }
      required: [group_id, agents_ids]
    outputs_schema: { properties: {} }
  - id: count_agents
    name: Count agents
    description: "Count agents matching the given filters."
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Filter by computer name" }
        os_type: { type: string, description: "Filter by OS type" }
        scan_status: { type: string, description: "Filter by scan status" }
        siteIds: { type: string, description: "Comma-separated site IDs" }
        groupIds: { type: string, description: "Comma-separated group IDs" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_agent_mac
    name: Get agent MAC addresses
    description: "Retrieve network interfaces (IP and MAC) for a single agent."
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent ID" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: get_installed_applications
    name: Get installed applications
    description: "Retrieve the applications installed on the given agents."
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: manage_tags
    name: Manage tags
    description: "Add, override or remove a tag on the given agents."
    inputs_schema:
      properties:
        tagId: { type: string, description: "Tag ID to apply" }
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
        operation: { type: string, description: "Tag operation: add, override or remove" }
      required: [tagId, agent_ids, operation]
    outputs_schema: { properties: {} }

  # ── Threats & Alerts ──────────────────────────────────────────────────────
  - id: resolve_threat
    name: Resolve threat
    description: "Mark one or more threats as resolved."
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." }
      required: [threat_ids]
    outputs_schema: { properties: {} }
  - id: mark_as_threat
    name: Mark as threat
    description: "Mark detections as a true threat, scoped to a site or the whole tenant."
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs to mark." }
        target_scope: { type: string, description: "Scope of the action: site or tenant." }
      required: [threat_ids, target_scope]
    outputs_schema: { properties: {} }
  - id: update_threats_verdict
    name: Update threats verdict
    description: "Set the analyst verdict on one or more threats."
    inputs_schema:
      properties:
        verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
        threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
      required: [verdict, threat_ids]
    outputs_schema: { properties: {} }
  - id: update_threats_status
    name: Update threats status
    description: "Set the incident status on one or more threats."
    inputs_schema:
      properties:
        status: { type: string, description: "in_progress, resolved, or unresolved." }
        threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
      required: [status, threat_ids]
    outputs_schema: { properties: {} }
  - id: get_threat_notes
    name: Get threat notes
    description: "Retrieve the notes attached to a single threat."
    inputs_schema:
      properties:
        threat_id: { type: string, description: "ID of the threat whose notes to retrieve." }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: get_threat_summary
    name: Get threat summary
    description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
    inputs_schema:
      properties:
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: fetch_threat_file
    name: Fetch threat file
    description: "Request the threat file for download, protected by a ZIP password."
    inputs_schema:
      properties:
        threat_id: { type: string, description: "ID of the threat whose file to fetch." }
        password: { type: string, description: "Password used to encrypt the fetched file ZIP." }
      required: [threat_id, password]
    outputs_schema: { properties: {} }
  - id: get_alerts
    name: Get alerts
    description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
    inputs_schema:
      properties:
        created_from: { type: string, description: "Return alerts created at or after this timestamp." }
        created_until: { type: string, description: "Return alerts created at or before this timestamp." }
        ruleName: { type: string, description: "Filter by rule name substring." }
        incidentStatus: { type: string, description: "Filter by incident status." }
        analystVerdict: { type: string, description: "Filter by analyst verdict." }
        alert_ids: { type: string, description: "Comma-separated alert IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: [created_from]
    outputs_schema: { properties: {} }
  - id: update_alerts_verdict
    name: Update alerts verdict
    description: "Set the analyst verdict on one or more cloud-detection alerts."
    inputs_schema:
      properties:
        verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
        alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
      required: [verdict, alert_ids]
    outputs_schema: { properties: {} }
  - id: update_alerts_status
    name: Update alerts status
    description: "Set the incident status on one or more cloud-detection alerts."
    inputs_schema:
      properties:
        status: { type: string, description: "in_progress, resolved, or unresolved." }
        alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
      required: [status, alert_ids]
    outputs_schema: { properties: {} }

  # ── Hash, blocklist, exclusions, IOCs ─────────────────────────────────────
  - id: get_blocklist
    name: Get blocklist
    description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
    inputs_schema:
      properties:
        global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." }
        hash: { type: string, description: "Filter by hash value substring." }
        offset: { type: number, description: "Records to skip for pagination." }
        limit: { type: number, description: "Max records to return (default 100)." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: add_hash_to_blocklist
    name: Add hash to blocklist
    description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
    inputs_schema:
      properties:
        os_type: { type: string, description: "Target OS type: windows, linux, or macos." }
        sha1: { type: string, description: "SHA1 hash (used if sha256 not provided)." }
        sha256: { type: string, description: "SHA256 hash (takes precedence over sha1)." }
        description: { type: string, description: "Optional description." }
        source: { type: string, description: "Source label (defaults to Riposte)." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
      required: [os_type]
    outputs_schema: { properties: {} }
  - id: remove_hash_from_blocklist
    name: Remove hash from blocklist
    description: "Find blocklist entries matching a SHA1 hash and delete them."
    inputs_schema:
      properties:
        sha1: { type: string, description: "SHA1 hash to remove." }
        os_type: { type: string, description: "Optional OS type filter." }
      required: [sha1]
    outputs_schema: { properties: {} }
  - id: get_white_list
    name: Get exclusions (white list)
    description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
    inputs_schema:
      properties:
        item_ids: { type: string, description: "Comma-separated exclusion item IDs." }
        os_types: { type: string, description: "Filter by OS types." }
        exclusion_type: { type: string, description: "Filter by exclusion type." }
        limit: { type: number, description: "Max records (default 10)." }
        include_parent: { type: boolean, description: "Include parent-scope exclusions." }
        include_children: { type: boolean, description: "Include child-scope exclusions." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: create_white_list_item
    name: Create exclusion item
    description: "Create an exclusion (whitelist) item of the given type and value."
    inputs_schema:
      properties:
        exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." }
        exclusion_value: { type: string, description: "The value to exclude." }
        os_type: { type: string, description: "Target OS type." }
        description: { type: string, description: "Optional description." }
        exclusion_mode: { type: string, description: "Optional exclusion mode." }
        path_exclusion_type: { type: string, description: "Optional path exclusion type." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
      required: [exclusion_type, exclusion_value, os_type]
    outputs_schema: { properties: {} }
  - id: remove_item_from_whitelist
    name: Remove exclusion item
    description: "Find exclusion items matching a value and delete them."
    inputs_schema:
      properties:
        item: { type: string, description: "The exclusion value to find and remove." }
        os_type: { type: string, description: "Optional OS type filter." }
        exclusion_type: { type: string, description: "Optional exclusion type filter." }
      required: [item]
    outputs_schema: { properties: {} }
  - id: delete_exclusion
    name: Delete exclusion
    description: "Delete exclusion items by their IDs and type."
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated exclusion item IDs to delete." }
        type: { type: string, description: "Exclusion type of the items being deleted." }
      required: [ids, type]
    outputs_schema: { properties: {} }
  - id: create_ioc
    name: Create IOC
    description: "Create a threat-intelligence IOC for the given account scope."
    inputs_schema:
      properties:
        name: { type: string, description: "Name of the IOC." }
        source: { type: string, description: "Source of the IOC." }
        type: { type: string, description: "IOC type: DNS, IPV4, IPV6, MD5, SHA1, SHA256, or URL." }
        method: { type: string, description: "Comparison method (e.g. EQUALS)." }
        validUntil: { type: string, description: "Expiration timestamp (ISO 8601)." }
        value: { type: string, description: "The IOC value." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        externalId: { type: string, description: "Optional external identifier." }
        description: { type: string, description: "Optional description." }
      required: [name, source, type, method, validUntil, value, account_ids]
    outputs_schema: { properties: {} }
  - id: delete_ioc
    name: Delete IOC
    description: "Delete threat-intelligence IOCs by UUID within the given account scope."
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        uuids: { type: string, description: "Comma-separated IOC UUIDs to delete." }
      required: [account_ids, uuids]
    outputs_schema: { properties: {} }
  - id: get_iocs
    name: Get IOCs
    description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max records (default 1000)." }
        type: { type: string, description: "Filter by IOC type." }
        value: { type: string, description: "Filter by IOC value." }
        source: { type: string, description: "Filter by IOC source." }
        name_contains: { type: string, description: "Filter by IOC name substring." }
      required: [account_ids]
    outputs_schema: { properties: {} }

  # ── Sites, groups, accounts, users, Deep Visibility ───────────────────────
  - id: get_activities
    name: Get activities
    description: "Retrieve activities, optionally filtered by date, agents, or threats."
    inputs_schema:
      properties:
        created_after: { type: string, description: "Activities created after this timestamp." }
        limit: { type: number, description: "Max results (default 50)." }
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
        threats_ids: { type: string, description: "Comma-separated threat IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_groups
    name: Get groups
    description: "List groups with optional filters."
    inputs_schema:
      properties:
        group_type: { type: string, description: "Group type (static, dynamic)." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        is_default: { type: boolean, description: "Filter for default groups only." }
        name: { type: string, description: "Exact group name." }
        query: { type: string, description: "Free-text search." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }
  - id: delete_group
    name: Delete group
    description: "Delete a group by its ID."
    inputs_schema:
      properties:
        group_id: { type: string, description: "ID of the group to delete." }
      required: [group_id]
    outputs_schema: { properties: {} }
  - id: get_sites
    name: Get sites
    description: "List sites with optional filters."
    inputs_schema:
      properties:
        query: { type: string, description: "Free-text search." }
        state: { type: string, description: "Site state (active, expired)." }
        site_type: { type: string, description: "Site type." }
        site_name: { type: string, description: "Exact site name." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_site
    name: Get site
    description: "Retrieve a single site by its ID."
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: reactivate_site
    name: Reactivate site
    description: "Reactivate an expired site."
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site to reactivate." }
        unlimited: { type: boolean, description: "Set the site to unlimited duration." }
        expiration: { type: string, description: "New expiration date (ISO 8601)." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: expire_site
    name: Expire site
    description: "Expire a site immediately."
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site to expire." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: get_accounts
    name: Get accounts
    description: "List all accounts, or retrieve a single account when an ID is provided."
    inputs_schema:
      properties:
        account_id: { type: string, description: "Optional account ID." }
      required: []
    outputs_schema: { properties: {} }
  - id: list_users
    name: List users
    description: "List users, optionally filtered by account IDs."
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }
  - id: delete_user
    name: Delete user
    description: "Delete a user by their ID."
    inputs_schema:
      properties:
        user_id: { type: string, description: "ID of the user to delete." }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: create_query
    name: Create DV query
    description: "Initialize a Deep Visibility query over a given time range."
    inputs_schema:
      properties:
        query: { type: string, description: "Deep Visibility query string." }
        from_date: { type: string, description: "Start of the time range (ISO 8601)." }
        to_date: { type: string, description: "End of the time range (ISO 8601)." }
      required: [query, from_date, to_date]
    outputs_schema: { properties: {} }
  - id: get_dv_query_status
    name: Get DV query status
    description: "Get the status of a Deep Visibility query by ID."
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
      required: [query_id]
    outputs_schema: { properties: {} }
  - id: get_events
    name: Get DV events
    description: "Retrieve events for a completed Deep Visibility query."
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
        limit: { type: number, description: "Max events (default 50)." }
        cursor: { type: string, description: "Pagination cursor." }
      required: [query_id]
    outputs_schema: { properties: {} }
  - id: get_processes
    name: Get DV processes
    description: "Retrieve process events for a completed Deep Visibility query."
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
        limit: { type: number, description: "Max process events (default 50)." }
      required: [query_id]
    outputs_schema: { properties: {} }

  # ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ──────
  - id: create_star_rule
    name: Create STAR rule
    description: "Create a STAR custom detection rule in Draft status."
    inputs_schema:
      properties:
        name: { type: string, description: "Rule name." }
        query: { type: string, description: "S1QL detection query." }
        rule_severity: { type: string, description: "Low | Medium | High | Critical." }
        expiration_mode: { type: string, description: "Permanent | Temporary." }
        query_type: { type: string, description: "Query type (defaults to events)." }
        network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
        treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
        description: { type: string, description: "Rule description." }
        expiration_date: { type: string, description: "Expiration date (when Temporary)." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
    outputs_schema: { properties: {} }
  - id: get_star_rules
    name: Get STAR rules
    description: "List STAR custom detection rules."
    inputs_schema:
      properties:
        status: { type: string, description: "Filter by rule status." }
        queryType: { type: string, description: "Filter by query type." }
        name_contains: { type: string, description: "Filter by name substring." }
        ruleIds: { type: string, description: "Comma-separated rule IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 1000)." }
      required: []
    outputs_schema: { properties: {} }
  - id: update_star_rule
    name: Update STAR rule
    description: "Update an existing STAR custom detection rule by ID."
    inputs_schema:
      properties:
        rule_id: { type: string, description: "ID of the rule to update." }
        name: { type: string, description: "Rule name." }
        query: { type: string, description: "S1QL detection query." }
        rule_severity: { type: string, description: "Low | Medium | High | Critical." }
        expiration_mode: { type: string, description: "Permanent | Temporary." }
        query_type: { type: string, description: "Query type (defaults to events)." }
        network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
        treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
        description: { type: string, description: "Rule description." }
        expiration_date: { type: string, description: "Expiration date (when Temporary)." }
        query_lang: { type: string, description: "Query language version." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
    outputs_schema: { properties: {} }
  - id: enable_star_rules
    name: Enable STAR rules
    description: "Enable one or more STAR custom detection rules by ID."
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to enable." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: disable_star_rules
    name: Disable STAR rules
    description: "Disable one or more STAR custom detection rules by ID."
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to disable." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: delete_star_rule
    name: Delete STAR rule
    description: "Delete one or more STAR custom detection rules by ID."
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to delete." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: run_remote_script
    name: Run remote script
    description: "Execute a remote script (RSO) on the targeted agents."
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        script_id: { type: string, description: "ID of the remote script to run." }
        output_destination: { type: string, description: "Where script output is sent." }
        task_description: { type: string, description: "Description of the task." }
        agent_ids: { type: string, description: "Comma-separated agent IDs to target." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        input_params: { type: string, description: "Input parameters passed to the script." }
        password: { type: string, description: "Password for protected scripts." }
        requires_approval: { type: boolean, description: "Whether execution requires approval." }
      required: [account_ids, script_id, output_destination, task_description]
    outputs_schema: { properties: {} }
  - id: create_endpoint_tag
    name: Create endpoint tag
    description: "Create an endpoint tag in the tag manager."
    inputs_schema:
      properties:
        type: { type: string, description: "Tag type." }
        key: { type: string, description: "Tag key." }
        value: { type: string, description: "Tag value." }
        description: { type: string, description: "Tag description." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        tenant: { type: boolean, description: "Apply at tenant scope." }
      required: [type, key]
    outputs_schema: { properties: {} }
  - id: delete_endpoint_tag
    name: Delete endpoint tag
    description: "Delete endpoint tags matching the given scope filter."
    inputs_schema:
      properties:
        siteIds: { type: string, description: "Comma-separated site IDs." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        query: { type: string, description: "Free-text query filter." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_endpoint_tags
    name: Get endpoint tags
    description: "List endpoint tags, optionally filtered by key or value substring."
    inputs_schema:
      properties:
        key__contains: { type: string, description: "Filter by key substring." }
        value__contains: { type: string, description: "Filter by value substring." }
      required: []
    outputs_schema: { properties: {} }
  - id: create_firewall_rule
    name: Create firewall rule
    description: "Create a firewall control rule scoped to an account or site."
    inputs_schema:
      properties:
        action: { type: string, description: "Allow | Block." }
        name: { type: string, description: "Rule name." }
        status: { type: string, description: "Enabled | Disabled." }
        description: { type: string, description: "Rule description." }
        direction: { type: string, description: "incoming | outgoing | any." }
        filter_type: { type: string, description: "Scope filter type: accountIds | siteIds." }
        filter_id: { type: string, description: "ID for the chosen scope filter type." }
        remote_host: { type: string, description: "Comma-separated remote host addresses." }
      required: [action, name, status, description, direction, filter_type, filter_id]
    outputs_schema: { properties: {} }
  - id: get_network_discovery_table
    name: Get network discovery table
    description: "Retrieve the Ranger network discovery table view."
    inputs_schema:
      properties:
        hostnames__contains: { type: string, description: "Filter by hostname substring." }
        externalIp: { type: string, description: "Filter by exact external IP." }
        externalIp__contains: { type: string, description: "Filter by external IP substring." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_network_discovery_assets
    name: Get network discovery assets
    description: "Retrieve XDR network discovery surface assets."
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 50)." }
        account_id: { type: string, description: "Account ID filter." }
        site_id: { type: string, description: "Site ID filter." }
        hostname: { type: string, description: "Filter by name substring." }
        epp_status: { type: string, description: "Filter by EPP unsupported/unknown status." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_shadow_assets
    name: Get shadow assets
    description: "Retrieve XDR shadow assets with optional coverage filters."
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 50)." }
        account_id: { type: string, description: "Account ID filter." }
        site_id: { type: string, description: "Site ID filter." }
        name: { type: string, description: "Filter by name substring." }
        active_coverage: { type: string, description: "Filter by active coverage." }
        missing_coverage: { type: string, description: "Filter by missing coverage." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_gateways
    name: Get gateways
    description: "List Ranger gateways."
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: purge_crash_dumps
    name: Purge crash dumps
    description: "Purge agent crash dumps for the specified agents."
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: list_endpoints_with_application
    name: List endpoints with application
    description: "List the application inventory across endpoints."
    inputs_schema:
      properties:
        groupIds: { type: string, description: "Comma-separated group IDs." }
        name__contains: { type: string, description: "Filter by application name substring." }
        osTypes: { type: string, description: "Filter by OS types." }
        vendor__contains: { type: string, description: "Filter by vendor substring." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 10)." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_app_inventory_endpoints
    name: Get app inventory endpoints
    description: "List endpoints that have a given application installed."
    inputs_schema:
      properties:
        applicationName: { type: string, description: "Application name filter." }
        applicationVendor: { type: string, description: "Application vendor filter." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        cursor: { type: string, description: "Pagination cursor." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }