id: sentinelone name: SentinelOne version: 1.17.2 description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan." changelog: "1.17.2 — update_uam_alert_assignee reads the alert back after assigning it. A real run came back with the alert under success while the console still showed its previous assignee, and the block passed: the mutation only says the console accepted the action. The script now reads the alert's assignee for up to seven seconds and fails when it is not the requested user, printing who the console holds instead — an id that is not the console user's shows up there rather than as a green block. The three UAM updates (assignee, status, verdict) also fail when the console lists the alert under failure or skip, or under neither: it answers those with a 200 and no errors, so they read as done updates. 1.17.1 — update_uam_alert_assignee never assigned anything: its mutation declared the action id as String! and the user as ID!, where the console types them ID! and Long, and the console refused it at validation (VariableTypeMismatch) before touching the alert. Both now carry the console's types. The user id goes out as a number, and a value that is not the numeric console id — an email, a name — is refused with an error naming assignee_user_id instead of a GraphQL type mismatch. 1.17.0 — The unified-alert OCSF mapper, corrected and completed against a real SentinelOne Identity alert. It read asset.type for the device type, and asset.type is UNKNOWN on every alert whose surface is not the endpoint: a domain controller the same alert called a Server was ingested as an unknown device. asset.category is read first now, with a numeric device.type_id beside it. device.ip took the IPv6 address ahead of the IPv4, so every Windows host carried a link-local fe80:: address nothing can pivot on — and which the indicator extractor mined as an IOC all the same; the v4 address wins and the v6 is kept beside it. The alert's flat file summary was written straight into observables, and an alert with no file — identity, cloud — ended up with one observable whose name and value were both the literal string N/A: the summary now fills file.name, and its hash the file.hashes entry its digest length names, only when the process block did not already describe the file. src_endpoint and dst_endpoint are oriented by the detection instead of by habit: SentinelOne fills detectionTime.attacker only when a party distinct from the asset is involved, so its presence now decides which way the pair points — attacker as the source and the asset as the destination when it is filled, the asset as the source and no destination when it is not. Mapping the attacker to dst_endpoint unconditionally announced a domain controller as the source of the Active Directory enumeration it had in fact suffered. device.* is the invariant across both branches, and the asset's full OS version moved onto it, its cloud classifier under unmapped, so the flip costs nothing. finding_info.types is a list, as OCSF and the layout generator both expect. The base event had no clock of its own — time, start_time and end_time are set from detectedAt, firstSeenAt and lastSeenAt, so a timeline no longer falls back to the moment Riposte polled. 47 entries added, 97 to 144, covering every one of the 120 fields the query fetches: severity_id and status_id, the console scope's group, the alert as its own metadata.uid, finding_info.product, rule.category, container.orchestrator, the assignee's id, and the detection-time OS name, domain and logged-in user. 23 of them sit under unmapped.* — the Azure image, instance size and resource tags, the console-side IP, the Kubernetes cluster, namespace, node and controller, the agent's connectivity, pending reboot and policy, the ticket and whether a note exists — surfaced for the page instead of being left in the raw payload. Checked by running the platform's own jsonata-go mapping engine over the real Identity alert, over a STAR alert fetched with_details, over an alert naming only the attacker's address, and over a bare alert: no expression errors on any of them, and the process chain, evidences, attacks and observables come out unchanged. 1.16.0 — count_agents takes the three version comparators missing beside the agentVersion__gt it already had: agentVersion__gte, agentVersion__lt and agentVersion__lte. Sent together they bound a range, so a fleet can be counted on a band of builds rather than only above one; alone, __lte or __lt answers what is still to be upgraded to a target build, which __gt could not ask. Each is left out of the query when empty. 1.15.0 — The incident's process-tree block now draws itself for a unified alert. It rendered the chain already, reading actor.process.file.name, but it places itself automatically only on a mapper declaring actor.process.name next to the parent's, which this one did not — so a generated layout left the block out and the chain went unseen. Mapping the process name to both, plus certSubject to the node's signer badge. Checked by running the block's own reader over the mapper's output on a real alert: explorer.exe to powershell.exe, with the host, the user, and paths and hashes on both nodes when the fetch ran with_details. 1.14.0 — OCSF mapper corrected against a real STAR alert. Its alert-level observables list was empty while every observable sat under the indicators, so the two are now appended instead of reading the alert level alone — 12 observables where the mapper saw none. The same alert had process.username null while its indicators named the user, and named its parent process without hashing it anywhere else, so actor.user.name, actor.process.parent_process.file.path and its three hashes are read from the indicator observables, with the alert's own field winning when filled in. attacks and relatedAlerts are guarded on $count rather than $exists: that alert carries attacks: null, which exists in JSONata and would have written an empty array. Verified end to end through the scheduler's own jsonata-go build, with and without with_details. 1.13.0 — get_unified_alerts takes with_details, which enriches every alert it returns with what only the per-alert view carries: the indicators behind the detection, their MITRE ATT&CK tactic and technique, the observables, the related alerts and the process user. The list nodes alone were too thin to triage on. Read in aliased batches of ten, so a default-limit fetch costs ten extra requests rather than a hundred, and merged under the list node so the richer list fields win on the fields both carry. Best effort: an alert the console will not detail keeps its list fields and the shortfall is reported in pagination.details, rather than failing a fetch that already succeeded. Off by default — a rule that does not set it sends the same queries as before. The OCSF mapper maps the new fields: evidences, finding_info.attacks, finding_info.related_events, the full observables list and the process user. 1.12.0 — get_unified_alerts takes an account_ids filter, so a multi-tenant console can be ingested one account at a time, as get_threats and get_alerts already allowed. Filtered on the scope the alert sits in now (realTime.scope.account.id), falling back to the scope it was detected in and then to a filter over the fetched alerts, the same ladder as the category; pagination.accountFilter reports which ran. 1.11.0 — Absorbs the SentinelOne SDL package, which covered the same unified (UAM) alerts from a second integration: one console, one instance, one set of credentials. get_unified_alerts gains the SDL filters — classification, attack_surface, os_type, asset_id, external_id, search_text, unassigned_only, unmitigated_only and a detectedAt window — status, severity, analyst_verdict and analytics_category take comma-separated lists, and every time input also reads a relative window ('24 hours'). Three capabilities the SDL package had and this one did not: get_unified_alert_details (indicators, their MITRE mapping, observables, related alerts), add_uam_alert_note and trigger_uam_alert_action (any console action by ID). update_uam_alert_assignee completes the status/verdict pair. update_uam_alert_status and _verdict now report a GraphQL error instead of printing it as a successful update. analytics_category filters the fetch to one analytic category, e.g. only the platform-rule alerts (analyticsCategory=Platform Rule, the console's own filter): sent as a server-side filter under either fieldId spelling, and applied to the fetched alerts if the console rejects both, rather than failing the fetch — pagination.categoryFilter reports which ran. The sort argument is likewise tried in both spellings. 1.9.0 — Every command now declares its risk tier, so the agent approval gate can tell a lookup from an action. Only test_connection and get_unified_alerts did; the other 83 were unset, and an unset risk is treated as destructive, which put get-threats and get-alerts behind the same gate as isolate-agent and run-remote-script. 39 read, 22 safe_write, 24 destructive. Destructive covers what removes detection or protection (exclusions, disabling or editing a STAR rule), what adds blocking (blocklist, firewall rule), what changes containment in either direction (isolate and reconnect both), what reboots or shuts a host down, and every delete. 1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1." category: endpoint # Per-instance configuration. The scripts build the API base as /web/api/v2.1. config_schema: properties: url: type: string description: SentinelOne console URL, e.g. https://usea1.sentinelone.net api_token: type: string description: API token (console → My User → API Token) x-soar-sensitive: true required: - url - api_token # Documented for reference; the bundled scripts build the header themselves # (Authorization: ApiToken ). auth: - id: apitoken type: api_key in: header name: Authorization value_template: "ApiToken {{secret}}" secret_field: api_token commands: # ── Enrichment / read ───────────────────────────────────────────────────── - id: get_threats name: sentinelone-get-threats description: List threats/detections matching filters. risk: read inputs_schema: properties: limit: { type: number, description: "Max results (default 20)" } mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" } query: { type: string, description: "Free-text (hash, file, computer name, uuid)" } threat_ids: { type: string, description: "Comma-separated threat IDs" } created_after: { type: string, description: "ISO8601 lower bound on createdAt" } account_ids: { type: string, description: "Optional comma-separated account IDs to scope the search to." } required: [] outputs_schema: { properties: {} } ingest: results_path: data dedup_key: id incremental_field: created_after - id: list_agents name: sentinelone-list-agents description: List endpoints (agents) matching filters. risk: read inputs_schema: properties: computer_name: { type: string, description: "Substring match on computer name" } os_type: { type: string, description: "windows | macos | linux" } is_active: { type: boolean, description: "Only active agents" } limit: { type: number, description: "Max results (default 50)" } required: [] outputs_schema: { properties: {} } - id: get_agent name: sentinelone-get-agent description: Get details for one or more agents by ID. risk: read inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } required: [agent_ids] outputs_schema: { properties: {} } - id: get_hash_verdict name: sentinelone-get-hash-verdict description: Reputation verdict for a SHA1 hash. risk: read inputs_schema: properties: hash: { type: string, description: "SHA1 hash" } required: [hash] outputs_schema: { properties: {} } # ── Response ────────────────────────────────────────────────────────────── - id: isolate_agent name: sentinelone-isolate-agent description: Disconnect agents from the network. risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } required: [agent_ids] outputs_schema: { properties: {} } - id: reconnect_agent name: sentinelone-reconnect-agent description: Reconnect agents to the network. risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } required: [agent_ids] outputs_schema: { properties: {} } - id: mitigate_threat name: sentinelone-mitigate-threat description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback). risk: destructive inputs_schema: properties: action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" } threat_ids: { type: string, description: "Comma-separated threat IDs" } required: [action, threat_ids] outputs_schema: { properties: {} } - id: initiate_scan name: sentinelone-initiate-scan description: Start a full disk scan on agents. risk: safe_write inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } required: [agent_ids] outputs_schema: { properties: {} } - id: write_threat_note name: sentinelone-write-threat-note description: Add a note to one or more threats. risk: safe_write inputs_schema: properties: threat_ids: { type: string, description: "Comma-separated threat IDs" } note: { type: string, description: "Note text" } required: [threat_ids, note] outputs_schema: { properties: {} } # ── Agents: actions & info ──────────────────────────────────────────────── - id: shutdown_agent name: sentinelone-shutdown-agent description: "Send a shutdown command to agents matching the filter." risk: destructive inputs_schema: properties: agent_id: { type: string, description: "Comma-separated agent IDs" } group_id: { type: string, description: "Comma-separated group IDs" } query: { type: string, description: "Free-text agent match" } required: [] outputs_schema: { properties: {} } - id: uninstall_agent name: sentinelone-uninstall-agent description: "Send an uninstall command to agents matching the filter." risk: destructive inputs_schema: properties: agent_id: { type: string, description: "Comma-separated agent IDs" } group_id: { type: string, description: "Comma-separated group IDs" } query: { type: string, description: "Free-text agent match" } required: [] outputs_schema: { properties: {} } - id: broadcast_message name: sentinelone-broadcast-message description: "Broadcast a message to agents matching the filter." risk: safe_write inputs_schema: properties: message: { type: string, description: "Message to broadcast to agents" } agent_id: { type: string, description: "Comma-separated agent IDs" } group_id: { type: string, description: "Comma-separated group IDs" } active_agent: { type: boolean, description: "Only target active agents" } required: [message] outputs_schema: { properties: {} } - id: enable_agent name: sentinelone-enable-agent description: "Enable agents matching the given IDs, optionally rebooting them." risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } shouldReboot: { type: boolean, description: "Reboot agents after enabling" } required: [agent_ids] outputs_schema: { properties: {} } - id: move_agent name: sentinelone-move-agent description: "Move agents into the specified group." risk: destructive inputs_schema: properties: group_id: { type: string, description: "Target group ID" } agents_ids: { type: string, description: "Comma-separated agent IDs to move" } required: [group_id, agents_ids] outputs_schema: { properties: {} } - id: count_agents name: sentinelone-count-agents description: "Count agents matching the given filters." risk: read inputs_schema: properties: computer_name: { type: string, description: "Filter by computer name" } os_type: { type: string, description: "Filter by OS type" } scan_status: { type: string, description: "Filter by scan status" } siteIds: { type: string, description: "Comma-separated site IDs" } groupIds: { type: string, description: "Comma-separated group IDs" } accountIds: { type: string, description: "Comma-separated account IDs, to scope the count to one or more accounts" } agentVersion__gt: { type: string, description: "Only agents on a version strictly greater than this one, e.g. 23.4.2.6" } agentVersion__gte: { type: string, description: "Only agents on this version or newer, e.g. 23.4.2.6" } agentVersion__lt: { type: string, description: "Only agents on a version strictly older than this one, e.g. 23.4.2.6" } agentVersion__lte: { type: string, description: "Only agents on this version or older, e.g. 23.4.2.6 — the fleet still to be upgraded to it" } networkStatuses: { type: string, description: "Comma-separated network statuses: connected | connecting | disconnected | disconnecting" } operationalStatesNin: { type: string, description: "Comma-separated operational states to exclude, e.g. na" } machineTypes: { type: string, description: "Comma-separated machine types: desktop | laptop | server | kubernetes node | storage | unknown" } isActive: { type: string, description: "true to count only active agents, false for only the inactive ones; leave empty to count both" } required: [] outputs_schema: { properties: {} } - id: get_agent_mac name: sentinelone-get-agent-mac description: "Retrieve network interfaces (IP and MAC) for a single agent." risk: read inputs_schema: properties: agent_id: { type: string, description: "Agent ID" } required: [agent_id] outputs_schema: { properties: {} } - id: get_installed_applications name: sentinelone-get-installed-applications description: "Retrieve the applications installed on the given agents." risk: read inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs" } required: [agent_ids] outputs_schema: { properties: {} } - id: manage_tags name: sentinelone-manage-tags description: "Add, override or remove a tag on the given agents." risk: safe_write inputs_schema: properties: tagId: { type: string, description: "Tag ID to apply" } agent_ids: { type: string, description: "Comma-separated agent IDs" } operation: { type: string, description: "Tag operation: add, override or remove" } required: [tagId, agent_ids, operation] outputs_schema: { properties: {} } # ── Threats & Alerts ────────────────────────────────────────────────────── - id: resolve_threat name: sentinelone-resolve-threat description: "Mark one or more threats as resolved." risk: safe_write inputs_schema: properties: threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." } required: [threat_ids] outputs_schema: { properties: {} } - id: mark_as_threat name: sentinelone-mark-as-threat description: "Mark detections as a true threat, scoped to a site or the whole tenant." risk: safe_write inputs_schema: properties: threat_ids: { type: string, description: "Comma-separated threat IDs to mark." } target_scope: { type: string, description: "Scope of the action: site or tenant." } required: [threat_ids, target_scope] outputs_schema: { properties: {} } - id: update_threats_verdict name: sentinelone-update-threats-verdict description: "Set the analyst verdict on one or more threats." risk: safe_write inputs_schema: properties: verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." } threat_ids: { type: string, description: "Comma-separated threat IDs to update." } required: [verdict, threat_ids] outputs_schema: { properties: {} } - id: update_threats_status name: sentinelone-update-threats-status description: "Set the incident status on one or more threats." risk: safe_write inputs_schema: properties: status: { type: string, description: "in_progress, resolved, or unresolved." } threat_ids: { type: string, description: "Comma-separated threat IDs to update." } required: [status, threat_ids] outputs_schema: { properties: {} } - id: get_threat_notes name: sentinelone-get-threat-notes description: "Retrieve the notes attached to a single threat." risk: read inputs_schema: properties: threat_id: { type: string, description: "ID of the threat whose notes to retrieve." } required: [threat_id] outputs_schema: { properties: {} } - id: get_threat_summary name: sentinelone-get-threat-summary description: "Retrieve a dashboard threat summary, optionally filtered by site and group." risk: read inputs_schema: properties: site_ids: { type: string, description: "Comma-separated site IDs." } group_ids: { type: string, description: "Comma-separated group IDs." } required: [] outputs_schema: { properties: {} } - id: fetch_threat_file name: sentinelone-fetch-threat-file description: "Request the threat file for download, protected by a ZIP password." risk: safe_write inputs_schema: properties: threat_id: { type: string, description: "ID of the threat whose file to fetch." } password: { type: string, description: "Password used to encrypt the fetched file ZIP." } required: [threat_id, password] outputs_schema: { properties: {} } - id: get_alerts name: sentinelone-get-alerts description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria." risk: read inputs_schema: properties: created_from: { type: string, description: "Return alerts created at or after this timestamp." } created_until: { type: string, description: "Return alerts created at or before this timestamp." } ruleName: { type: string, description: "Filter by rule name substring." } incidentStatus: { type: string, description: "Filter by incident status." } analystVerdict: { type: string, description: "Filter by analyst verdict." } alert_ids: { type: string, description: "Comma-separated alert IDs." } site_ids: { type: string, description: "Comma-separated site IDs." } account_ids: { type: string, description: "Optional comma-separated account IDs to scope the search to." } limit: { type: number, description: "Max results (default 100)." } required: [created_from] outputs_schema: { properties: {} } ingest: results_path: data dedup_key: id incremental_field: created_from - id: update_alerts_verdict name: sentinelone-update-alerts-verdict description: "Set the analyst verdict on one or more cloud-detection alerts." risk: safe_write inputs_schema: properties: verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." } alert_ids: { type: string, description: "Comma-separated alert IDs to update." } required: [verdict, alert_ids] outputs_schema: { properties: {} } - id: update_alerts_status name: sentinelone-update-alerts-status description: "Set the incident status on one or more cloud-detection alerts." risk: safe_write inputs_schema: properties: status: { type: string, description: "in_progress, resolved, or unresolved." } alert_ids: { type: string, description: "Comma-separated alert IDs to update." } required: [status, alert_ids] outputs_schema: { properties: {} } # ── Hash, blocklist, exclusions, IOCs ───────────────────────────────────── - id: get_blocklist name: sentinelone-get-blocklist description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination." risk: read inputs_schema: properties: global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." } hash: { type: string, description: "Filter by hash value substring." } offset: { type: number, description: "Records to skip for pagination." } limit: { type: number, description: "Max records to return (default 100)." } site_ids: { type: string, description: "Comma-separated site IDs." } group_ids: { type: string, description: "Comma-separated group IDs." } account_ids: { type: string, description: "Comma-separated account IDs." } required: [] outputs_schema: { properties: {} } - id: add_hash_to_blocklist name: sentinelone-add-hash-to-blocklist description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope." risk: destructive inputs_schema: properties: os_type: { type: string, description: "Target OS type: windows, linux, or macos." } sha1: { type: string, description: "SHA1 hash (used if sha256 not provided)." } sha256: { type: string, description: "SHA256 hash (takes precedence over sha1)." } description: { type: string, description: "Optional description." } source: { type: string, description: "Source label (defaults to Riposte)." } account_ids: { type: string, description: "Comma-separated account IDs." } site_ids: { type: string, description: "Comma-separated site IDs." } group_ids: { type: string, description: "Comma-separated group IDs." } required: [os_type] outputs_schema: { properties: {} } - id: remove_hash_from_blocklist name: sentinelone-remove-hash-from-blocklist description: "Find blocklist entries matching a SHA1 hash and delete them." risk: destructive inputs_schema: properties: sha1: { type: string, description: "SHA1 hash to remove." } os_type: { type: string, description: "Optional OS type filter." } required: [sha1] outputs_schema: { properties: {} } - id: get_white_list name: sentinelone-get-white-list description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope." risk: read inputs_schema: properties: item_ids: { type: string, description: "Comma-separated exclusion item IDs." } os_types: { type: string, description: "Filter by OS types." } exclusion_type: { type: string, description: "Filter by exclusion type." } limit: { type: number, description: "Max records (default 10)." } include_parent: { type: boolean, description: "Include parent-scope exclusions." } include_children: { type: boolean, description: "Include child-scope exclusions." } site_ids: { type: string, description: "Comma-separated site IDs." } required: [] outputs_schema: { properties: {} } - id: create_white_list_item name: sentinelone-create-white-list-item description: "Create an exclusion (whitelist) item of the given type and value." risk: destructive inputs_schema: properties: exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." } exclusion_value: { type: string, description: "The value to exclude." } os_type: { type: string, description: "Target OS type." } description: { type: string, description: "Optional description." } exclusion_mode: { type: string, description: "Optional exclusion mode." } path_exclusion_type: { type: string, description: "Optional path exclusion type." } group_ids: { type: string, description: "Comma-separated group IDs." } site_ids: { type: string, description: "Comma-separated site IDs." } required: [exclusion_type, exclusion_value, os_type] outputs_schema: { properties: {} } - id: remove_item_from_whitelist name: sentinelone-remove-item-from-whitelist description: "Find exclusion items matching a value and delete them." risk: destructive inputs_schema: properties: item: { type: string, description: "The exclusion value to find and remove." } os_type: { type: string, description: "Optional OS type filter." } exclusion_type: { type: string, description: "Optional exclusion type filter." } required: [item] outputs_schema: { properties: {} } - id: delete_exclusion name: sentinelone-delete-exclusion description: "Delete exclusion items by their IDs and type." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated exclusion item IDs to delete." } type: { type: string, description: "Exclusion type of the items being deleted." } required: [ids, type] outputs_schema: { properties: {} } - id: create_ioc name: sentinelone-create-ioc description: "Create a threat-intelligence IOC for the given account scope." risk: safe_write inputs_schema: properties: name: { type: string, description: "Name of the IOC." } source: { type: string, description: "Source of the IOC." } type: { type: string, description: "IOC type: DNS, IPV4, IPV6, MD5, SHA1, SHA256, or URL." } method: { type: string, description: "Comparison method (e.g. EQUALS)." } validUntil: { type: string, description: "Expiration timestamp (ISO 8601)." } value: { type: string, description: "The IOC value." } account_ids: { type: string, description: "Comma-separated account IDs." } externalId: { type: string, description: "Optional external identifier." } description: { type: string, description: "Optional description." } required: [name, source, type, method, validUntil, value, account_ids] outputs_schema: { properties: {} } - id: delete_ioc name: sentinelone-delete-ioc description: "Delete threat-intelligence IOCs by UUID within the given account scope." risk: destructive inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } uuids: { type: string, description: "Comma-separated IOC UUIDs to delete." } required: [account_ids, uuids] outputs_schema: { properties: {} } - id: get_iocs name: sentinelone-get-iocs description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name." risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } limit: { type: number, description: "Max records (default 1000)." } type: { type: string, description: "Filter by IOC type." } value: { type: string, description: "Filter by IOC value." } source: { type: string, description: "Filter by IOC source." } name_contains: { type: string, description: "Filter by IOC name substring." } required: [account_ids] outputs_schema: { properties: {} } # ── Sites, groups, accounts, users, Deep Visibility ─────────────────────── - id: get_activities name: sentinelone-get-activities description: "Retrieve activities, optionally filtered by date, agents, or threats." risk: read inputs_schema: properties: created_after: { type: string, description: "Activities created after this timestamp." } limit: { type: number, description: "Max results (default 50)." } agent_ids: { type: string, description: "Comma-separated agent IDs." } threats_ids: { type: string, description: "Comma-separated threat IDs." } required: [] outputs_schema: { properties: {} } - id: get_groups name: sentinelone-get-groups description: "List groups with optional filters." risk: read inputs_schema: properties: group_type: { type: string, description: "Group type (static, dynamic)." } group_ids: { type: string, description: "Comma-separated group IDs." } is_default: { type: boolean, description: "Filter for default groups only." } name: { type: string, description: "Exact group name." } query: { type: string, description: "Free-text search." } limit: { type: number, description: "Max results (default 50)." } required: [] outputs_schema: { properties: {} } - id: delete_group name: sentinelone-delete-group description: "Delete a group by its ID." risk: destructive inputs_schema: properties: group_id: { type: string, description: "ID of the group to delete." } required: [group_id] outputs_schema: { properties: {} } - id: get_sites name: sentinelone-get-sites description: "List sites with optional filters." risk: read inputs_schema: properties: query: { type: string, description: "Free-text search." } state: { type: string, description: "Site state (active, expired)." } site_type: { type: string, description: "Site type." } site_name: { type: string, description: "Exact site name." } site_ids: { type: string, description: "Comma-separated site IDs." } limit: { type: number, description: "Max results (default 50)." } required: [] outputs_schema: { properties: {} } - id: get_site name: sentinelone-get-site description: "Retrieve a single site by its ID." risk: read inputs_schema: properties: site_id: { type: string, description: "ID of the site." } required: [site_id] outputs_schema: { properties: {} } - id: reactivate_site name: sentinelone-reactivate-site description: "Reactivate an expired site." risk: safe_write inputs_schema: properties: site_id: { type: string, description: "ID of the site to reactivate." } unlimited: { type: boolean, description: "Set the site to unlimited duration." } expiration: { type: string, description: "New expiration date (ISO 8601)." } required: [site_id] outputs_schema: { properties: {} } - id: expire_site name: sentinelone-expire-site description: "Expire a site immediately." risk: destructive inputs_schema: properties: site_id: { type: string, description: "ID of the site to expire." } required: [site_id] outputs_schema: { properties: {} } - id: get_accounts name: sentinelone-get-accounts description: "List all accounts, or retrieve a single account when an ID is provided." risk: read inputs_schema: properties: account_id: { type: string, description: "Optional account ID." } required: [] outputs_schema: { properties: {} } - id: list_users name: sentinelone-list-users description: "List users, optionally filtered by account IDs." risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } limit: { type: number, description: "Max results (default 100)." } required: [] outputs_schema: { properties: {} } - id: delete_user name: sentinelone-delete-user description: "Delete a user by their ID." risk: destructive inputs_schema: properties: user_id: { type: string, description: "ID of the user to delete." } required: [user_id] outputs_schema: { properties: {} } - id: create_query name: sentinelone-create-query description: "Initialize a Deep Visibility query over a given time range." risk: safe_write inputs_schema: properties: query: { type: string, description: "Deep Visibility query string." } from_date: { type: string, description: "Start of the time range (ISO 8601)." } to_date: { type: string, description: "End of the time range (ISO 8601)." } required: [query, from_date, to_date] outputs_schema: { properties: {} } - id: get_dv_query_status name: sentinelone-get-dv-query-status description: "Get the status of a Deep Visibility query by ID." risk: read inputs_schema: properties: query_id: { type: string, description: "ID of the Deep Visibility query." } required: [query_id] outputs_schema: { properties: {} } - id: get_events name: sentinelone-get-events description: "Retrieve events for a completed Deep Visibility query." risk: read inputs_schema: properties: query_id: { type: string, description: "ID of the Deep Visibility query." } limit: { type: number, description: "Max events (default 50)." } cursor: { type: string, description: "Pagination cursor." } required: [query_id] outputs_schema: { properties: {} } - id: get_processes name: sentinelone-get-processes description: "Retrieve process events for a completed Deep Visibility query." risk: read inputs_schema: properties: query_id: { type: string, description: "ID of the Deep Visibility query." } limit: { type: number, description: "Max process events (default 50)." } required: [query_id] outputs_schema: { properties: {} } # ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ────── - id: create_star_rule name: sentinelone-create-star-rule description: "Create a STAR custom detection rule in Draft status." risk: destructive inputs_schema: properties: name: { type: string, description: "Rule name." } query: { type: string, description: "S1QL detection query." } rule_severity: { type: string, description: "Low | Medium | High | Critical." } expiration_mode: { type: string, description: "Permanent | Temporary." } query_type: { type: string, description: "Query type (defaults to events)." } network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." } treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." } description: { type: string, description: "Rule description." } expiration_date: { type: string, description: "Expiration date (when Temporary)." } site_ids: { type: string, description: "Comma-separated site IDs." } group_ids: { type: string, description: "Comma-separated group IDs." } account_ids: { type: string, description: "Comma-separated account IDs." } required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat] outputs_schema: { properties: {} } - id: get_star_rules name: sentinelone-get-star-rules description: "List STAR custom detection rules." risk: read inputs_schema: properties: status: { type: string, description: "Filter by rule status." } queryType: { type: string, description: "Filter by query type." } name_contains: { type: string, description: "Filter by name substring." } ruleIds: { type: string, description: "Comma-separated rule IDs." } accountIds: { type: string, description: "Comma-separated account IDs." } siteIds: { type: string, description: "Comma-separated site IDs." } limit: { type: number, description: "Max results (default 1000)." } required: [] outputs_schema: { properties: {} } - id: update_star_rule name: sentinelone-update-star-rule description: "Update an existing STAR custom detection rule by ID." risk: destructive inputs_schema: properties: rule_id: { type: string, description: "ID of the rule to update." } name: { type: string, description: "Rule name." } query: { type: string, description: "S1QL detection query." } rule_severity: { type: string, description: "Low | Medium | High | Critical." } expiration_mode: { type: string, description: "Permanent | Temporary." } query_type: { type: string, description: "Query type (defaults to events)." } network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." } treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." } description: { type: string, description: "Rule description." } expiration_date: { type: string, description: "Expiration date (when Temporary)." } query_lang: { type: string, description: "Query language version." } site_ids: { type: string, description: "Comma-separated site IDs." } group_ids: { type: string, description: "Comma-separated group IDs." } account_ids: { type: string, description: "Comma-separated account IDs." } required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat] outputs_schema: { properties: {} } - id: enable_star_rules name: sentinelone-enable-star-rules description: "Enable one or more STAR custom detection rules by ID." risk: safe_write inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated rule IDs to enable." } required: [rule_ids] outputs_schema: { properties: {} } - id: disable_star_rules name: sentinelone-disable-star-rules description: "Disable one or more STAR custom detection rules by ID." risk: destructive inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated rule IDs to disable." } required: [rule_ids] outputs_schema: { properties: {} } - id: delete_star_rule name: sentinelone-delete-star-rule description: "Delete one or more STAR custom detection rules by ID." risk: destructive inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated rule IDs to delete." } required: [rule_ids] outputs_schema: { properties: {} } - id: run_remote_script name: sentinelone-run-remote-script description: "Execute a remote script (RSO) on the targeted agents." risk: destructive inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } script_id: { type: string, description: "ID of the remote script to run." } output_destination: { type: string, description: "Where script output is sent." } task_description: { type: string, description: "Description of the task." } agent_ids: { type: string, description: "Comma-separated agent IDs to target." } site_ids: { type: string, description: "Comma-separated site IDs." } input_params: { type: string, description: "Input parameters passed to the script." } password: { type: string, description: "Password for protected scripts." } requires_approval: { type: boolean, description: "Whether execution requires approval." } required: [account_ids, script_id, output_destination, task_description] outputs_schema: { properties: {} } - id: create_endpoint_tag name: sentinelone-create-endpoint-tag description: "Create an endpoint tag in the tag manager." risk: safe_write inputs_schema: properties: type: { type: string, description: "Tag type." } key: { type: string, description: "Tag key." } value: { type: string, description: "Tag value." } description: { type: string, description: "Tag description." } groupIds: { type: string, description: "Comma-separated group IDs." } siteIds: { type: string, description: "Comma-separated site IDs." } accountIds: { type: string, description: "Comma-separated account IDs." } tenant: { type: boolean, description: "Apply at tenant scope." } required: [type, key] outputs_schema: { properties: {} } - id: delete_endpoint_tag name: sentinelone-delete-endpoint-tag description: "Delete endpoint tags matching the given scope filter." risk: destructive inputs_schema: properties: siteIds: { type: string, description: "Comma-separated site IDs." } groupIds: { type: string, description: "Comma-separated group IDs." } accountIds: { type: string, description: "Comma-separated account IDs." } query: { type: string, description: "Free-text query filter." } required: [] outputs_schema: { properties: {} } - id: get_endpoint_tags name: sentinelone-get-endpoint-tags description: "List endpoint tags, optionally filtered by key or value substring." risk: read inputs_schema: properties: key__contains: { type: string, description: "Filter by key substring." } value__contains: { type: string, description: "Filter by value substring." } required: [] outputs_schema: { properties: {} } - id: create_firewall_rule name: sentinelone-create-firewall-rule description: "Create a firewall control rule scoped to an account or site." risk: destructive inputs_schema: properties: action: { type: string, description: "Allow | Block." } name: { type: string, description: "Rule name." } status: { type: string, description: "Enabled | Disabled." } description: { type: string, description: "Rule description." } direction: { type: string, description: "incoming | outgoing | any." } filter_type: { type: string, description: "Scope filter type: accountIds | siteIds." } filter_id: { type: string, description: "ID for the chosen scope filter type." } remote_host: { type: string, description: "Comma-separated remote host addresses." } required: [action, name, status, description, direction, filter_type, filter_id] outputs_schema: { properties: {} } - id: get_network_discovery_table name: sentinelone-get-network-discovery-table description: "Retrieve the Ranger network discovery table view." risk: read inputs_schema: properties: hostnames__contains: { type: string, description: "Filter by hostname substring." } externalIp: { type: string, description: "Filter by exact external IP." } externalIp__contains: { type: string, description: "Filter by external IP substring." } required: [] outputs_schema: { properties: {} } - id: get_network_discovery_assets name: sentinelone-get-network-discovery-assets description: "Retrieve XDR network discovery surface assets." risk: read inputs_schema: properties: limit: { type: number, description: "Max results (default 50)." } account_id: { type: string, description: "Account ID filter." } site_id: { type: string, description: "Site ID filter." } hostname: { type: string, description: "Filter by name substring." } epp_status: { type: string, description: "Filter by EPP unsupported/unknown status." } required: [] outputs_schema: { properties: {} } - id: get_shadow_assets name: sentinelone-get-shadow-assets description: "Retrieve XDR shadow assets with optional coverage filters." risk: read inputs_schema: properties: limit: { type: number, description: "Max results (default 50)." } account_id: { type: string, description: "Account ID filter." } site_id: { type: string, description: "Site ID filter." } name: { type: string, description: "Filter by name substring." } active_coverage: { type: string, description: "Filter by active coverage." } missing_coverage: { type: string, description: "Filter by missing coverage." } required: [] outputs_schema: { properties: {} } - id: get_gateways name: sentinelone-get-gateways description: "List Ranger gateways." risk: read inputs_schema: properties: {} required: [] outputs_schema: { properties: {} } - id: purge_crash_dumps name: sentinelone-purge-crash-dumps description: "Purge agent crash dumps for the specified agents." risk: destructive inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs." } required: [agent_ids] outputs_schema: { properties: {} } - id: list_endpoints_with_application name: sentinelone-list-endpoints-with-application description: "List the application inventory across endpoints." risk: read inputs_schema: properties: groupIds: { type: string, description: "Comma-separated group IDs." } name__contains: { type: string, description: "Filter by application name substring." } osTypes: { type: string, description: "Filter by OS types." } vendor__contains: { type: string, description: "Filter by vendor substring." } siteIds: { type: string, description: "Comma-separated site IDs." } limit: { type: number, description: "Max results (default 10)." } required: [] outputs_schema: { properties: {} } - id: get_app_inventory_endpoints name: sentinelone-get-app-inventory-endpoints description: "List endpoints that have a given application installed." risk: read inputs_schema: properties: applicationName: { type: string, description: "Application name filter." } applicationVendor: { type: string, description: "Application vendor filter." } siteIds: { type: string, description: "Comma-separated site IDs." } groupIds: { type: string, description: "Comma-separated group IDs." } accountIds: { type: string, description: "Comma-separated account IDs." } cursor: { type: string, description: "Pagination cursor." } limit: { type: number, description: "Max results (default 50)." } required: [] outputs_schema: { properties: {} } # ── Threat analysis / sample ────────────────────────────────────────────── - id: threat_analysis name: sentinelone-threat-analysis description: "Return the detailed analysis for a threat (agent, detection and threat info)." risk: read inputs_schema: properties: threat_id: { type: string, description: "Threat ID." } required: [threat_id] outputs_schema: { properties: {} } - id: threat_download_from_cloud name: sentinelone-threat-download-from-cloud description: "Get a download URL for a threat's sample from the cloud (BinaryVault)." risk: read inputs_schema: properties: threat_id: { type: string, description: "Threat ID." } required: [threat_id] outputs_schema: { properties: {} } # ── Endpoint actions ────────────────────────────────────────────────────── - id: abort_endpoint_scan name: sentinelone-abort-endpoint-scan description: "Abort the disk scan on the given agents." risk: safe_write inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs." } required: [agent_ids] outputs_schema: { properties: {} } - id: endpoint_fetch_logs name: sentinelone-endpoint-fetch-logs description: "Fetch agent/endpoint logs from the given agents." risk: safe_write inputs_schema: properties: agent_ids: { type: string, description: "Comma-separated agent IDs." } agents_logs: { type: boolean, description: "Fetch agent logs (default true)." } customer_facing_logs: { type: boolean, description: "Fetch customer-facing logs (default false)." } platform_logs: { type: boolean, description: "Fetch platform logs (default false)." } required: [agent_ids] outputs_schema: { properties: {} } - id: fetch_file name: sentinelone-fetch-file description: "Request a file fetch from an agent endpoint (collected as a password-protected zip)." risk: safe_write inputs_schema: properties: agent_id: { type: string, description: "Agent ID." } file_path: { type: string, description: "Absolute file path on the endpoint." } password: { type: string, description: "Password to protect the resulting zip." } required: [agent_id, file_path, password] outputs_schema: { properties: {} } # ── Remote scripts (status / results) ───────────────────────────────────── - id: get_remote_script_task_status name: sentinelone-get-remote-script-task-status description: "Get the status of remote-script tasks for a parent task." risk: read inputs_schema: properties: parent_task_id: { type: string, description: "Parent task ID." } ids: { type: string, description: "Comma-separated task IDs." } status: { type: string, description: "Filter by status (e.g. created, completed)." } computer_name_contains: { type: string, description: "Filter by computer name substring." } site_ids: { type: string, description: "Comma-separated site IDs." } account_ids: { type: string, description: "Comma-separated account IDs." } limit: { type: number, description: "Max results (default 50)." } required: [parent_task_id] outputs_schema: { properties: {} } - id: get_remote_script_task_results name: sentinelone-get-remote-script-task-results description: "Get download links for the results of remote-script tasks." risk: read inputs_schema: properties: task_ids: { type: string, description: "Comma-separated task IDs." } computer_names: { type: string, description: "Comma-separated computer names." } required: [task_ids] outputs_schema: { properties: {} } # ── Users / marketplace apps ────────────────────────────────────────────── - id: get_service_users name: sentinelone-get-service-users description: "List service users (API token accounts)." risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } role_ids: { type: string, description: "Comma-separated RBAC role IDs." } ids: { type: string, description: "Comma-separated service-user IDs." } site_ids: { type: string, description: "Comma-separated site IDs." } limit: { type: number, description: "Max results (default 100)." } required: [] outputs_schema: { properties: {} } - id: list_installed_singularity_marketplace_applications name: sentinelone-list-installed-singularity-marketplace-applications description: "List installed Singularity Marketplace applications." risk: read inputs_schema: properties: account_ids: { type: string, description: "Comma-separated account IDs." } application_catalog_id: { type: string, description: "Filter by application catalog ID." } creator_contains: { type: string, description: "Filter by creator substring." } ids: { type: string, description: "Comma-separated application IDs." } name_contains: { type: string, description: "Filter by application name substring." } site_ids: { type: string, description: "Comma-separated site IDs." } limit: { type: number, description: "Max results (default 100)." } required: [] outputs_schema: { properties: {} } # ── Unified (UAM) alerts ────────────────────────────────────────────────── # Console-wide alerts, served by the unifiedalerts GraphQL endpoint rather than # the REST v2.1 tree. A different object from the cloud-detection alert of # get_alerts: one alert per detection across every surface SentinelOne watches. - id: get_unified_alerts name: sentinelone-get-unified-alerts description: "Retrieve unified (UAM) alerts across endpoint, cloud, identity and third-party surfaces. Walks the cursor until the limit is reached." risk: read inputs_schema: properties: created_after: { type: string, description: "Return alerts created at or after this time (ISO8601 or epoch). The incremental field: leave empty and let the alert rule set it." } created_until: { type: string, description: "Return alerts created at or before this time (ISO8601, epoch, or a window like '24 hours')." } updated_after: { type: string, description: "Return alerts updated at or after this time. Set, it sorts on updatedAt instead of createdAt — use it to pick up alerts retriaged in the console, not to create incidents." } view_type: { type: string, description: "Surface to read: ALL (default) | CLOUD | CUSTOM_ALERTS | ENDPOINT | IDENTITY | STAR | THIRD_PARTY" } analytics_category: { type: string, description: "Filter on the detecting analytic's category, as the console spells it, e.g. 'Platform Rule' (analyticsCategory=Platform Rule) or 'STAR Rule'. Comma-separated for several. Left empty, every category is returned." } classification: { type: string, description: "Comma-separated classifications, e.g. MALWARE,RANSOMWARE,TROJAN." } attack_surface: { type: string, description: "Comma-separated attack surfaces: ENDPOINT,CLOUD,IDENTITY,NETWORK,EMAIL." } os_type: { type: string, description: "Comma-separated OS types of the affected asset: WINDOWS,LINUX,MACOS." } account_ids: { type: string, description: "Optional comma-separated account IDs to scope the fetch to, for a multi-tenant console. Matched against the account the alert is scoped to now, or the one it was detected in." } asset_id: { type: string, description: "Only alerts on this asset (comma-separated for several)." } external_id: { type: string, description: "Filter on the source's own alert ID (comma-separated for several)." } search_text: { type: string, description: "Free-text match on the alert name." } unassigned_only: { type: string, description: "true to return only the alerts with no assignee." } unmitigated_only: { type: string, description: "true to return only the alerts whose result is UNMITIGATED." } detected_after: { type: string, description: "Lower bound on detectedAt (ISO8601, epoch, or a window like '24 hours'). Detection time, as opposed to the console's ingestion time used by created_after." } detected_until: { type: string, description: "Upper bound on detectedAt." } status: { type: string, description: "Filter on alert status, e.g. NEW | IN_PROGRESS | RESOLVED. Comma-separated for several." } severity: { type: string, description: "Filter on severity: CRITICAL | HIGH | MEDIUM | LOW | INFO. Comma-separated for several." } analyst_verdict: { type: string, description: "Filter on analyst verdict, e.g. TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED. Comma-separated for several." } alert_id: { type: string, description: "Fetch one alert by its UUID." } with_details: { type: boolean, description: "Also read each alert's detail (indicators and their MITRE ATT&CK mapping, observables, related alerts, process user) and merge it into the alert. Costs one extra request per 10 alerts; leave off for a plain list fetch." } limit: { type: number, description: "Max alerts to return across pages (default 100)." } cursor: { type: string, description: "Resume from a previous run's pagination.endCursor." } required: [] outputs_schema: { properties: {} } ingest: results_path: data dedup_key: id incremental_field: created_after - id: get_unified_alert_details name: sentinelone-get-unified-alert-details description: "Full detail of one unified (UAM) alert: indicators and their MITRE ATT&CK mapping, observables, and the related alerts." risk: read inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } required: [alert_id] outputs_schema: { properties: {} } - id: update_uam_alert_status name: sentinelone-update-uam-alert-status description: "Update the status of a unified (UAM) alert." risk: safe_write inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } status: { type: string, description: "NEW | IN_PROGRESS | RESOLVED" } required: [alert_id, status] outputs_schema: { properties: {} } - id: update_uam_alert_verdict name: sentinelone-update-uam-alert-verdict description: "Update the analyst verdict of a unified (UAM) alert." risk: safe_write inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } analyst_verdict: { type: string, description: "Verdict enum, e.g. TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED." } required: [alert_id, analyst_verdict] outputs_schema: { properties: {} } - id: update_uam_alert_assignee name: sentinelone-update-uam-alert-assignee description: "Assign a unified (UAM) alert to a console user." risk: safe_write inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } assignee_user_id: { type: string, description: "Numeric console user ID to assign the alert to (the userId returned in assignee.userId, or a user's id from the users list)." } action_id: { type: string, description: "Console action ID, only if this tenant names it something other than S1/alert/assignUser." } required: [alert_id, assignee_user_id] outputs_schema: { properties: {} } - id: add_uam_alert_note name: sentinelone-add-uam-alert-note description: "Add an analyst note to a unified (UAM) alert. For the REST threat object, use sentinelone-write-threat-note instead." risk: safe_write inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } note_text: { type: string, description: "Note content." } required: [alert_id, note_text] outputs_schema: { properties: {} } - id: trigger_uam_alert_action name: sentinelone-trigger-uam-alert-action description: "Trigger any console action on a unified (UAM) alert — quarantine, kill, remediate, blocklist — by its action ID." risk: destructive inputs_schema: properties: alert_id: { type: string, description: "UAM alert ID (UUID)." } action_id: { type: string, description: "Console action ID, e.g. S1/alert/quarantine. The action IDs an alert offers are listed in the console." } action_type: { type: string, description: "Action type when the action takes one: QUARANTINE, UNQUARANTINE, KILL, REMEDIATE, BLOCKLIST_ADD, EXCLUSION_ADD." } payload_json: { type: string, description: "Extra payload as a JSON object, for the actions that take more than a type." } required: [alert_id, action_id] outputs_schema: { properties: {} } # ── PowerQuery (Singularity Data Lake) ──────────────────────────────────── - id: run_powerquery name: sentinelone-run-powerquery description: "Run a PowerQuery against the Singularity Data Lake (separate XDR URL + Log Read API key)." risk: read inputs_schema: properties: singularity_xdr_url: { type: string, description: "Singularity Data Lake XDR URL (https://...)." } singularity_xdr_api_key: { type: string, description: "Log Read Access API key." } query: { type: string, description: "PowerQuery syntax query." } start_time: { type: string, description: "Query start time." } end_time: { type: string, description: "Query end time." } priority: { type: string, description: "Execution priority (default low)." } recurring: { type: boolean, description: "Create a materialized view (default false)." } team_emails: { type: string, description: "Comma-separated account emails for cross-team search." } required: [singularity_xdr_url, singularity_xdr_api_key, query] outputs_schema: { properties: {} } # ── Dynamic asset tag rule (XDR) ────────────────────────────────────────── - id: create_tag_rule name: sentinelone-create-tag-rule description: "Create a dynamic asset tag rule (XDR) that tags assets matching a property filter." risk: safe_write inputs_schema: properties: name: { type: string, description: "Rule name." } account_id: { type: string, description: "Account ID the rule belongs to." } tag_id: { type: string, description: "Existing tag ID to apply." } filter_values: { type: string, description: "Comma-separated values (e.g. SRV-,WEB-)." } filter_name: { type: string, description: "Asset property to filter on (default assetName)." } filter_operand: { type: string, description: "startsWith | contains | equals | endsWith (default startsWith)." } conditions_operand: { type: string, description: "and | or (default or)." } scope_type: { type: string, description: "account | site | global (default account)." } site_ids: { type: string, description: "Site ID(s); first is used when scope_type=site." } status: { type: string, description: "enabled | disabled (default enabled)." } description: { type: string, description: "Rule description." } required: [name, account_id, tag_id, filter_values] outputs_schema: { properties: {} } # ── Connectivity test ───────────────────────────────────────────────────── - id: test_connection name: sentinelone-test-connection description: "Verify connectivity and credentials (used by the Test button)." risk: read inputs_schema: properties: {} required: [] outputs_schema: { properties: {} } ingestion: command: get_threats mapper: get_threats default_incident_type: "SentinelOne Threat"