id: sentinelone
name: SentinelOne
version: 1.0.0
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
changelog: "1.0.0 — Initial release: threats, agents, hash verdict, isolate/reconnect, mitigate, scan, threat notes."
category: endpoint

# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
config_schema:
  properties:
    url:
      type: string
      description: SentinelOne console URL, e.g. https://usea1.sentinelone.net
    api_token:
      type: string
      description: API token (console → My User → API Token)
      x-soar-sensitive: true
  required:
    - url
    - api_token

# Documented for reference; the bundled scripts build the header themselves
# (Authorization: ApiToken <token>).
auth:
  - id: apitoken
    type: api_key
    in: header
    name: Authorization
    value_template: "ApiToken {{secret}}"
    secret_field: api_token

commands:
  # ── Enrichment / read ─────────────────────────────────────────────────────
  - id: get_threats
    name: Get threats
    description: List threats/detections matching filters.
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 20)" }
        mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" }
        query: { type: string, description: "Free-text (hash, file, computer name, uuid)" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
      required: []
    outputs_schema: { properties: {} }

  - id: list_agents
    name: List agents
    description: List endpoints (agents) matching filters.
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Substring match on computer name" }
        os_type: { type: string, description: "windows | macos | linux" }
        is_active: { type: boolean, description: "Only active agents" }
        limit: { type: number, description: "Max results (default 50)" }
      required: []
    outputs_schema: { properties: {} }

  - id: get_agent
    name: Get agent
    description: Get details for one or more agents by ID.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: get_hash_verdict
    name: Get hash verdict
    description: Reputation verdict for a SHA1 hash.
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA1 hash" }
      required: [hash]
    outputs_schema: { properties: {} }

  # ── Response ──────────────────────────────────────────────────────────────
  - id: isolate_agent
    name: Isolate agent (disconnect)
    description: Disconnect agents from the network.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: reconnect_agent
    name: Reconnect agent
    description: Reconnect agents to the network.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: mitigate_threat
    name: Mitigate threat
    description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
    inputs_schema:
      properties:
        action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
      required: [action, threat_ids]
    outputs_schema: { properties: {} }

  - id: initiate_scan
    name: Initiate endpoint scan
    description: Start a full disk scan on agents.
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: write_threat_note
    name: Add threat note
    description: Add a note to one or more threats.
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        note: { type: string, description: "Note text" }
      required: [threat_ids, note]
    outputs_schema: { properties: {} }