riposte-marketplace/integrations/sentinelone/manifest.yaml

id: sentinelone
name: SentinelOne
version: 1.13.0
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
changelog: "1.13.0 — get_unified_alerts takes with_details, which enriches every alert it returns with what only the per-alert view carries: the indicators behind the detection, their MITRE ATT&CK tactic and technique, the observables, the related alerts and the process user. The list nodes alone were too thin to triage on. Read in aliased batches of ten, so a default-limit fetch costs ten extra requests rather than a hundred, and merged under the list node so the richer list fields win on the fields both carry. Best effort: an alert the console will not detail keeps its list fields and the shortfall is reported in pagination.details, rather than failing a fetch that already succeeded. Off by default — a rule that does not set it sends the same queries as before. The OCSF mapper maps the new fields: evidences, finding_info.attacks, finding_info.related_events, the full observables list and the process user. 1.12.0 — get_unified_alerts takes an account_ids filter, so a multi-tenant console can be ingested one account at a time, as get_threats and get_alerts already allowed. Filtered on the scope the alert sits in now (realTime.scope.account.id), falling back to the scope it was detected in and then to a filter over the fetched alerts, the same ladder as the category; pagination.accountFilter reports which ran. 1.11.0 — Absorbs the SentinelOne SDL package, which covered the same unified (UAM) alerts from a second integration: one console, one instance, one set of credentials. get_unified_alerts gains the SDL filters — classification, attack_surface, os_type, asset_id, external_id, search_text, unassigned_only, unmitigated_only and a detectedAt window — status, severity, analyst_verdict and analytics_category take comma-separated lists, and every time input also reads a relative window ('24 hours'). Three capabilities the SDL package had and this one did not: get_unified_alert_details (indicators, their MITRE mapping, observables, related alerts), add_uam_alert_note and trigger_uam_alert_action (any console action by ID). update_uam_alert_assignee completes the status/verdict pair. update_uam_alert_status and _verdict now report a GraphQL error instead of printing it as a successful update. analytics_category filters the fetch to one analytic category, e.g. only the platform-rule alerts (analyticsCategory=Platform Rule, the console's own filter): sent as a server-side filter under either fieldId spelling, and applied to the fetched alerts if the console rejects both, rather than failing the fetch — pagination.categoryFilter reports which ran. The sort argument is likewise tried in both spellings. 1.9.0 — Every command now declares its risk tier, so the agent approval gate can tell a lookup from an action. Only test_connection and get_unified_alerts did; the other 83 were unset, and an unset risk is treated as destructive, which put get-threats and get-alerts behind the same gate as isolate-agent and run-remote-script. 39 read, 22 safe_write, 24 destructive. Destructive covers what removes detection or protection (exclusions, disabling or editing a STAR rule), what adds blocking (blocklist, firewall rule), what changes containment in either direction (isolate and reconnect both), what reboots or shuts a host down, and every delete. 1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
category: endpoint

# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
config_schema:
  properties:
    url:
      type: string
      description: SentinelOne console URL, e.g. https://usea1.sentinelone.net
    api_token:
      type: string
      description: API token (console → My User → API Token)
      x-soar-sensitive: true
  required:
    - url
    - api_token

# Documented for reference; the bundled scripts build the header themselves
# (Authorization: ApiToken <token>).
auth:
  - id: apitoken
    type: api_key
    in: header
    name: Authorization
    value_template: "ApiToken {{secret}}"
    secret_field: api_token

commands:
  # ── Enrichment / read ─────────────────────────────────────────────────────
  - id: get_threats
    name: sentinelone-get-threats
    description: List threats/detections matching filters.
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 20)" }
        mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" }
        query: { type: string, description: "Free-text (hash, file, computer name, uuid)" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
        account_ids: { type: string, description: "Optional comma-separated account IDs to scope the search to." }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
      incremental_field: created_after

  - id: list_agents
    name: sentinelone-list-agents
    description: List endpoints (agents) matching filters.
    risk: read
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Substring match on computer name" }
        os_type: { type: string, description: "windows | macos | linux" }
        is_active: { type: boolean, description: "Only active agents" }
        limit: { type: number, description: "Max results (default 50)" }
      required: []
    outputs_schema: { properties: {} }

  - id: get_agent
    name: sentinelone-get-agent
    description: Get details for one or more agents by ID.
    risk: read
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: get_hash_verdict
    name: sentinelone-get-hash-verdict
    description: Reputation verdict for a SHA1 hash.
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA1 hash" }
      required: [hash]
    outputs_schema: { properties: {} }

  # ── Response ──────────────────────────────────────────────────────────────
  - id: isolate_agent
    name: sentinelone-isolate-agent
    description: Disconnect agents from the network.
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: reconnect_agent
    name: sentinelone-reconnect-agent
    description: Reconnect agents to the network.
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: mitigate_threat
    name: sentinelone-mitigate-threat
    description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
    risk: destructive
    inputs_schema:
      properties:
        action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
      required: [action, threat_ids]
    outputs_schema: { properties: {} }

  - id: initiate_scan
    name: sentinelone-initiate-scan
    description: Start a full disk scan on agents.
    risk: safe_write
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: write_threat_note
    name: sentinelone-write-threat-note
    description: Add a note to one or more threats.
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        note: { type: string, description: "Note text" }
      required: [threat_ids, note]
    outputs_schema: { properties: {} }

  # ── Agents: actions & info ────────────────────────────────────────────────
  - id: shutdown_agent
    name: sentinelone-shutdown-agent
    description: "Send a shutdown command to agents matching the filter."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        query: { type: string, description: "Free-text agent match" }
      required: []
    outputs_schema: { properties: {} }
  - id: uninstall_agent
    name: sentinelone-uninstall-agent
    description: "Send an uninstall command to agents matching the filter."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        query: { type: string, description: "Free-text agent match" }
      required: []
    outputs_schema: { properties: {} }
  - id: broadcast_message
    name: sentinelone-broadcast-message
    description: "Broadcast a message to agents matching the filter."
    risk: safe_write
    inputs_schema:
      properties:
        message: { type: string, description: "Message to broadcast to agents" }
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        active_agent: { type: boolean, description: "Only target active agents" }
      required: [message]
    outputs_schema: { properties: {} }
  - id: enable_agent
    name: sentinelone-enable-agent
    description: "Enable agents matching the given IDs, optionally rebooting them."
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
        shouldReboot: { type: boolean, description: "Reboot agents after enabling" }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: move_agent
    name: sentinelone-move-agent
    description: "Move agents into the specified group."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "Target group ID" }
        agents_ids: { type: string, description: "Comma-separated agent IDs to move" }
      required: [group_id, agents_ids]
    outputs_schema: { properties: {} }
  - id: count_agents
    name: sentinelone-count-agents
    description: "Count agents matching the given filters."
    risk: read
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Filter by computer name" }
        os_type: { type: string, description: "Filter by OS type" }
        scan_status: { type: string, description: "Filter by scan status" }
        siteIds: { type: string, description: "Comma-separated site IDs" }
        groupIds: { type: string, description: "Comma-separated group IDs" }
        accountIds: { type: string, description: "Comma-separated account IDs, to scope the count to one or more accounts" }
        agentVersion__gt: { type: string, description: "Only agents on a version strictly greater than this one, e.g. 23.4.2.6" }
        networkStatuses: { type: string, description: "Comma-separated network statuses: connected | connecting | disconnected | disconnecting" }
        operationalStatesNin: { type: string, description: "Comma-separated operational states to exclude, e.g. na" }
        machineTypes: { type: string, description: "Comma-separated machine types: desktop | laptop | server | kubernetes node | storage | unknown" }
        isActive: { type: string, description: "true to count only active agents, false for only the inactive ones; leave empty to count both" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_agent_mac
    name: sentinelone-get-agent-mac
    description: "Retrieve network interfaces (IP and MAC) for a single agent."
    risk: read
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent ID" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: get_installed_applications
    name: sentinelone-get-installed-applications
    description: "Retrieve the applications installed on the given agents."
    risk: read
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: manage_tags
    name: sentinelone-manage-tags
    description: "Add, override or remove a tag on the given agents."
    risk: safe_write
    inputs_schema:
      properties:
        tagId: { type: string, description: "Tag ID to apply" }
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
        operation: { type: string, description: "Tag operation: add, override or remove" }
      required: [tagId, agent_ids, operation]
    outputs_schema: { properties: {} }

  # ── Threats & Alerts ──────────────────────────────────────────────────────
  - id: resolve_threat
    name: sentinelone-resolve-threat
    description: "Mark one or more threats as resolved."
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." }
      required: [threat_ids]
    outputs_schema: { properties: {} }
  - id: mark_as_threat
    name: sentinelone-mark-as-threat
    description: "Mark detections as a true threat, scoped to a site or the whole tenant."
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs to mark." }
        target_scope: { type: string, description: "Scope of the action: site or tenant." }
      required: [threat_ids, target_scope]
    outputs_schema: { properties: {} }
  - id: update_threats_verdict
    name: sentinelone-update-threats-verdict
    description: "Set the analyst verdict on one or more threats."
    risk: safe_write
    inputs_schema:
      properties:
        verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
        threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
      required: [verdict, threat_ids]
    outputs_schema: { properties: {} }
  - id: update_threats_status
    name: sentinelone-update-threats-status
    description: "Set the incident status on one or more threats."
    risk: safe_write
    inputs_schema:
      properties:
        status: { type: string, description: "in_progress, resolved, or unresolved." }
        threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
      required: [status, threat_ids]
    outputs_schema: { properties: {} }
  - id: get_threat_notes
    name: sentinelone-get-threat-notes
    description: "Retrieve the notes attached to a single threat."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "ID of the threat whose notes to retrieve." }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: get_threat_summary
    name: sentinelone-get-threat-summary
    description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
    risk: read
    inputs_schema:
      properties:
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: fetch_threat_file
    name: sentinelone-fetch-threat-file
    description: "Request the threat file for download, protected by a ZIP password."
    risk: safe_write
    inputs_schema:
      properties:
        threat_id: { type: string, description: "ID of the threat whose file to fetch." }
        password: { type: string, description: "Password used to encrypt the fetched file ZIP." }
      required: [threat_id, password]
    outputs_schema: { properties: {} }
  - id: get_alerts
    name: sentinelone-get-alerts
    description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
    risk: read
    inputs_schema:
      properties:
        created_from: { type: string, description: "Return alerts created at or after this timestamp." }
        created_until: { type: string, description: "Return alerts created at or before this timestamp." }
        ruleName: { type: string, description: "Filter by rule name substring." }
        incidentStatus: { type: string, description: "Filter by incident status." }
        analystVerdict: { type: string, description: "Filter by analyst verdict." }
        alert_ids: { type: string, description: "Comma-separated alert IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        account_ids: { type: string, description: "Optional comma-separated account IDs to scope the search to." }
        limit: { type: number, description: "Max results (default 100)." }
      required: [created_from]
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
      incremental_field: created_from
  - id: update_alerts_verdict
    name: sentinelone-update-alerts-verdict
    description: "Set the analyst verdict on one or more cloud-detection alerts."
    risk: safe_write
    inputs_schema:
      properties:
        verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
        alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
      required: [verdict, alert_ids]
    outputs_schema: { properties: {} }
  - id: update_alerts_status
    name: sentinelone-update-alerts-status
    description: "Set the incident status on one or more cloud-detection alerts."
    risk: safe_write
    inputs_schema:
      properties:
        status: { type: string, description: "in_progress, resolved, or unresolved." }
        alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
      required: [status, alert_ids]
    outputs_schema: { properties: {} }

  # ── Hash, blocklist, exclusions, IOCs ─────────────────────────────────────
  - id: get_blocklist
    name: sentinelone-get-blocklist
    description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
    risk: read
    inputs_schema:
      properties:
        global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." }
        hash: { type: string, description: "Filter by hash value substring." }
        offset: { type: number, description: "Records to skip for pagination." }
        limit: { type: number, description: "Max records to return (default 100)." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: add_hash_to_blocklist
    name: sentinelone-add-hash-to-blocklist
    description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
    risk: destructive
    inputs_schema:
      properties:
        os_type: { type: string, description: "Target OS type: windows, linux, or macos." }
        sha1: { type: string, description: "SHA1 hash (used if sha256 not provided)." }
        sha256: { type: string, description: "SHA256 hash (takes precedence over sha1)." }
        description: { type: string, description: "Optional description." }
        source: { type: string, description: "Source label (defaults to Riposte)." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
      required: [os_type]
    outputs_schema: { properties: {} }
  - id: remove_hash_from_blocklist
    name: sentinelone-remove-hash-from-blocklist
    description: "Find blocklist entries matching a SHA1 hash and delete them."
    risk: destructive
    inputs_schema:
      properties:
        sha1: { type: string, description: "SHA1 hash to remove." }
        os_type: { type: string, description: "Optional OS type filter." }
      required: [sha1]
    outputs_schema: { properties: {} }
  - id: get_white_list
    name: sentinelone-get-white-list
    description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
    risk: read
    inputs_schema:
      properties:
        item_ids: { type: string, description: "Comma-separated exclusion item IDs." }
        os_types: { type: string, description: "Filter by OS types." }
        exclusion_type: { type: string, description: "Filter by exclusion type." }
        limit: { type: number, description: "Max records (default 10)." }
        include_parent: { type: boolean, description: "Include parent-scope exclusions." }
        include_children: { type: boolean, description: "Include child-scope exclusions." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: create_white_list_item
    name: sentinelone-create-white-list-item
    description: "Create an exclusion (whitelist) item of the given type and value."
    risk: destructive
    inputs_schema:
      properties:
        exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." }
        exclusion_value: { type: string, description: "The value to exclude." }
        os_type: { type: string, description: "Target OS type." }
        description: { type: string, description: "Optional description." }
        exclusion_mode: { type: string, description: "Optional exclusion mode." }
        path_exclusion_type: { type: string, description: "Optional path exclusion type." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
      required: [exclusion_type, exclusion_value, os_type]
    outputs_schema: { properties: {} }
  - id: remove_item_from_whitelist
    name: sentinelone-remove-item-from-whitelist
    description: "Find exclusion items matching a value and delete them."
    risk: destructive
    inputs_schema:
      properties:
        item: { type: string, description: "The exclusion value to find and remove." }
        os_type: { type: string, description: "Optional OS type filter." }
        exclusion_type: { type: string, description: "Optional exclusion type filter." }
      required: [item]
    outputs_schema: { properties: {} }
  - id: delete_exclusion
    name: sentinelone-delete-exclusion
    description: "Delete exclusion items by their IDs and type."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated exclusion item IDs to delete." }
        type: { type: string, description: "Exclusion type of the items being deleted." }
      required: [ids, type]
    outputs_schema: { properties: {} }
  - id: create_ioc
    name: sentinelone-create-ioc
    description: "Create a threat-intelligence IOC for the given account scope."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Name of the IOC." }
        source: { type: string, description: "Source of the IOC." }
        type: { type: string, description: "IOC type: DNS, IPV4, IPV6, MD5, SHA1, SHA256, or URL." }
        method: { type: string, description: "Comparison method (e.g. EQUALS)." }
        validUntil: { type: string, description: "Expiration timestamp (ISO 8601)." }
        value: { type: string, description: "The IOC value." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        externalId: { type: string, description: "Optional external identifier." }
        description: { type: string, description: "Optional description." }
      required: [name, source, type, method, validUntil, value, account_ids]
    outputs_schema: { properties: {} }
  - id: delete_ioc
    name: sentinelone-delete-ioc
    description: "Delete threat-intelligence IOCs by UUID within the given account scope."
    risk: destructive
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        uuids: { type: string, description: "Comma-separated IOC UUIDs to delete." }
      required: [account_ids, uuids]
    outputs_schema: { properties: {} }
  - id: get_iocs
    name: sentinelone-get-iocs
    description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max records (default 1000)." }
        type: { type: string, description: "Filter by IOC type." }
        value: { type: string, description: "Filter by IOC value." }
        source: { type: string, description: "Filter by IOC source." }
        name_contains: { type: string, description: "Filter by IOC name substring." }
      required: [account_ids]
    outputs_schema: { properties: {} }

  # ── Sites, groups, accounts, users, Deep Visibility ───────────────────────
  - id: get_activities
    name: sentinelone-get-activities
    description: "Retrieve activities, optionally filtered by date, agents, or threats."
    risk: read
    inputs_schema:
      properties:
        created_after: { type: string, description: "Activities created after this timestamp." }
        limit: { type: number, description: "Max results (default 50)." }
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
        threats_ids: { type: string, description: "Comma-separated threat IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_groups
    name: sentinelone-get-groups
    description: "List groups with optional filters."
    risk: read
    inputs_schema:
      properties:
        group_type: { type: string, description: "Group type (static, dynamic)." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        is_default: { type: boolean, description: "Filter for default groups only." }
        name: { type: string, description: "Exact group name." }
        query: { type: string, description: "Free-text search." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }
  - id: delete_group
    name: sentinelone-delete-group
    description: "Delete a group by its ID."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "ID of the group to delete." }
      required: [group_id]
    outputs_schema: { properties: {} }
  - id: get_sites
    name: sentinelone-get-sites
    description: "List sites with optional filters."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Free-text search." }
        state: { type: string, description: "Site state (active, expired)." }
        site_type: { type: string, description: "Site type." }
        site_name: { type: string, description: "Exact site name." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_site
    name: sentinelone-get-site
    description: "Retrieve a single site by its ID."
    risk: read
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: reactivate_site
    name: sentinelone-reactivate-site
    description: "Reactivate an expired site."
    risk: safe_write
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site to reactivate." }
        unlimited: { type: boolean, description: "Set the site to unlimited duration." }
        expiration: { type: string, description: "New expiration date (ISO 8601)." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: expire_site
    name: sentinelone-expire-site
    description: "Expire a site immediately."
    risk: destructive
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site to expire." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: get_accounts
    name: sentinelone-get-accounts
    description: "List all accounts, or retrieve a single account when an ID is provided."
    risk: read
    inputs_schema:
      properties:
        account_id: { type: string, description: "Optional account ID." }
      required: []
    outputs_schema: { properties: {} }
  - id: list_users
    name: sentinelone-list-users
    description: "List users, optionally filtered by account IDs."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }
  - id: delete_user
    name: sentinelone-delete-user
    description: "Delete a user by their ID."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "ID of the user to delete." }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: create_query
    name: sentinelone-create-query
    description: "Initialize a Deep Visibility query over a given time range."
    risk: safe_write
    inputs_schema:
      properties:
        query: { type: string, description: "Deep Visibility query string." }
        from_date: { type: string, description: "Start of the time range (ISO 8601)." }
        to_date: { type: string, description: "End of the time range (ISO 8601)." }
      required: [query, from_date, to_date]
    outputs_schema: { properties: {} }
  - id: get_dv_query_status
    name: sentinelone-get-dv-query-status
    description: "Get the status of a Deep Visibility query by ID."
    risk: read
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
      required: [query_id]
    outputs_schema: { properties: {} }
  - id: get_events
    name: sentinelone-get-events
    description: "Retrieve events for a completed Deep Visibility query."
    risk: read
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
        limit: { type: number, description: "Max events (default 50)." }
        cursor: { type: string, description: "Pagination cursor." }
      required: [query_id]
    outputs_schema: { properties: {} }
  - id: get_processes
    name: sentinelone-get-processes
    description: "Retrieve process events for a completed Deep Visibility query."
    risk: read
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
        limit: { type: number, description: "Max process events (default 50)." }
      required: [query_id]
    outputs_schema: { properties: {} }

  # ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ──────
  - id: create_star_rule
    name: sentinelone-create-star-rule
    description: "Create a STAR custom detection rule in Draft status."
    risk: destructive
    inputs_schema:
      properties:
        name: { type: string, description: "Rule name." }
        query: { type: string, description: "S1QL detection query." }
        rule_severity: { type: string, description: "Low | Medium | High | Critical." }
        expiration_mode: { type: string, description: "Permanent | Temporary." }
        query_type: { type: string, description: "Query type (defaults to events)." }
        network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
        treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
        description: { type: string, description: "Rule description." }
        expiration_date: { type: string, description: "Expiration date (when Temporary)." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
    outputs_schema: { properties: {} }
  - id: get_star_rules
    name: sentinelone-get-star-rules
    description: "List STAR custom detection rules."
    risk: read
    inputs_schema:
      properties:
        status: { type: string, description: "Filter by rule status." }
        queryType: { type: string, description: "Filter by query type." }
        name_contains: { type: string, description: "Filter by name substring." }
        ruleIds: { type: string, description: "Comma-separated rule IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 1000)." }
      required: []
    outputs_schema: { properties: {} }
  - id: update_star_rule
    name: sentinelone-update-star-rule
    description: "Update an existing STAR custom detection rule by ID."
    risk: destructive
    inputs_schema:
      properties:
        rule_id: { type: string, description: "ID of the rule to update." }
        name: { type: string, description: "Rule name." }
        query: { type: string, description: "S1QL detection query." }
        rule_severity: { type: string, description: "Low | Medium | High | Critical." }
        expiration_mode: { type: string, description: "Permanent | Temporary." }
        query_type: { type: string, description: "Query type (defaults to events)." }
        network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
        treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
        description: { type: string, description: "Rule description." }
        expiration_date: { type: string, description: "Expiration date (when Temporary)." }
        query_lang: { type: string, description: "Query language version." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
    outputs_schema: { properties: {} }
  - id: enable_star_rules
    name: sentinelone-enable-star-rules
    description: "Enable one or more STAR custom detection rules by ID."
    risk: safe_write
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to enable." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: disable_star_rules
    name: sentinelone-disable-star-rules
    description: "Disable one or more STAR custom detection rules by ID."
    risk: destructive
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to disable." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: delete_star_rule
    name: sentinelone-delete-star-rule
    description: "Delete one or more STAR custom detection rules by ID."
    risk: destructive
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to delete." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: run_remote_script
    name: sentinelone-run-remote-script
    description: "Execute a remote script (RSO) on the targeted agents."
    risk: destructive
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        script_id: { type: string, description: "ID of the remote script to run." }
        output_destination: { type: string, description: "Where script output is sent." }
        task_description: { type: string, description: "Description of the task." }
        agent_ids: { type: string, description: "Comma-separated agent IDs to target." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        input_params: { type: string, description: "Input parameters passed to the script." }
        password: { type: string, description: "Password for protected scripts." }
        requires_approval: { type: boolean, description: "Whether execution requires approval." }
      required: [account_ids, script_id, output_destination, task_description]
    outputs_schema: { properties: {} }
  - id: create_endpoint_tag
    name: sentinelone-create-endpoint-tag
    description: "Create an endpoint tag in the tag manager."
    risk: safe_write
    inputs_schema:
      properties:
        type: { type: string, description: "Tag type." }
        key: { type: string, description: "Tag key." }
        value: { type: string, description: "Tag value." }
        description: { type: string, description: "Tag description." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        tenant: { type: boolean, description: "Apply at tenant scope." }
      required: [type, key]
    outputs_schema: { properties: {} }
  - id: delete_endpoint_tag
    name: sentinelone-delete-endpoint-tag
    description: "Delete endpoint tags matching the given scope filter."
    risk: destructive
    inputs_schema:
      properties:
        siteIds: { type: string, description: "Comma-separated site IDs." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        query: { type: string, description: "Free-text query filter." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_endpoint_tags
    name: sentinelone-get-endpoint-tags
    description: "List endpoint tags, optionally filtered by key or value substring."
    risk: read
    inputs_schema:
      properties:
        key__contains: { type: string, description: "Filter by key substring." }
        value__contains: { type: string, description: "Filter by value substring." }
      required: []
    outputs_schema: { properties: {} }
  - id: create_firewall_rule
    name: sentinelone-create-firewall-rule
    description: "Create a firewall control rule scoped to an account or site."
    risk: destructive
    inputs_schema:
      properties:
        action: { type: string, description: "Allow | Block." }
        name: { type: string, description: "Rule name." }
        status: { type: string, description: "Enabled | Disabled." }
        description: { type: string, description: "Rule description." }
        direction: { type: string, description: "incoming | outgoing | any." }
        filter_type: { type: string, description: "Scope filter type: accountIds | siteIds." }
        filter_id: { type: string, description: "ID for the chosen scope filter type." }
        remote_host: { type: string, description: "Comma-separated remote host addresses." }
      required: [action, name, status, description, direction, filter_type, filter_id]
    outputs_schema: { properties: {} }
  - id: get_network_discovery_table
    name: sentinelone-get-network-discovery-table
    description: "Retrieve the Ranger network discovery table view."
    risk: read
    inputs_schema:
      properties:
        hostnames__contains: { type: string, description: "Filter by hostname substring." }
        externalIp: { type: string, description: "Filter by exact external IP." }
        externalIp__contains: { type: string, description: "Filter by external IP substring." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_network_discovery_assets
    name: sentinelone-get-network-discovery-assets
    description: "Retrieve XDR network discovery surface assets."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 50)." }
        account_id: { type: string, description: "Account ID filter." }
        site_id: { type: string, description: "Site ID filter." }
        hostname: { type: string, description: "Filter by name substring." }
        epp_status: { type: string, description: "Filter by EPP unsupported/unknown status." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_shadow_assets
    name: sentinelone-get-shadow-assets
    description: "Retrieve XDR shadow assets with optional coverage filters."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 50)." }
        account_id: { type: string, description: "Account ID filter." }
        site_id: { type: string, description: "Site ID filter." }
        name: { type: string, description: "Filter by name substring." }
        active_coverage: { type: string, description: "Filter by active coverage." }
        missing_coverage: { type: string, description: "Filter by missing coverage." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_gateways
    name: sentinelone-get-gateways
    description: "List Ranger gateways."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: purge_crash_dumps
    name: sentinelone-purge-crash-dumps
    description: "Purge agent crash dumps for the specified agents."
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: list_endpoints_with_application
    name: sentinelone-list-endpoints-with-application
    description: "List the application inventory across endpoints."
    risk: read
    inputs_schema:
      properties:
        groupIds: { type: string, description: "Comma-separated group IDs." }
        name__contains: { type: string, description: "Filter by application name substring." }
        osTypes: { type: string, description: "Filter by OS types." }
        vendor__contains: { type: string, description: "Filter by vendor substring." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 10)." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_app_inventory_endpoints
    name: sentinelone-get-app-inventory-endpoints
    description: "List endpoints that have a given application installed."
    risk: read
    inputs_schema:
      properties:
        applicationName: { type: string, description: "Application name filter." }
        applicationVendor: { type: string, description: "Application vendor filter." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        cursor: { type: string, description: "Pagination cursor." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  # ── Threat analysis / sample ──────────────────────────────────────────────
  - id: threat_analysis
    name: sentinelone-threat-analysis
    description: "Return the detailed analysis for a threat (agent, detection and threat info)."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat ID." }
      required: [threat_id]
    outputs_schema: { properties: {} }

  - id: threat_download_from_cloud
    name: sentinelone-threat-download-from-cloud
    description: "Get a download URL for a threat's sample from the cloud (BinaryVault)."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat ID." }
      required: [threat_id]
    outputs_schema: { properties: {} }

  # ── Endpoint actions ──────────────────────────────────────────────────────
  - id: abort_endpoint_scan
    name: sentinelone-abort-endpoint-scan
    description: "Abort the disk scan on the given agents."
    risk: safe_write
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: endpoint_fetch_logs
    name: sentinelone-endpoint-fetch-logs
    description: "Fetch agent/endpoint logs from the given agents."
    risk: safe_write
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
        agents_logs: { type: boolean, description: "Fetch agent logs (default true)." }
        customer_facing_logs: { type: boolean, description: "Fetch customer-facing logs (default false)." }
        platform_logs: { type: boolean, description: "Fetch platform logs (default false)." }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: fetch_file
    name: sentinelone-fetch-file
    description: "Request a file fetch from an agent endpoint (collected as a password-protected zip)."
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent ID." }
        file_path: { type: string, description: "Absolute file path on the endpoint." }
        password: { type: string, description: "Password to protect the resulting zip." }
      required: [agent_id, file_path, password]
    outputs_schema: { properties: {} }

  # ── Remote scripts (status / results) ─────────────────────────────────────
  - id: get_remote_script_task_status
    name: sentinelone-get-remote-script-task-status
    description: "Get the status of remote-script tasks for a parent task."
    risk: read
    inputs_schema:
      properties:
        parent_task_id: { type: string, description: "Parent task ID." }
        ids: { type: string, description: "Comma-separated task IDs." }
        status: { type: string, description: "Filter by status (e.g. created, completed)." }
        computer_name_contains: { type: string, description: "Filter by computer name substring." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max results (default 50)." }
      required: [parent_task_id]
    outputs_schema: { properties: {} }

  - id: get_remote_script_task_results
    name: sentinelone-get-remote-script-task-results
    description: "Get download links for the results of remote-script tasks."
    risk: read
    inputs_schema:
      properties:
        task_ids: { type: string, description: "Comma-separated task IDs." }
        computer_names: { type: string, description: "Comma-separated computer names." }
      required: [task_ids]
    outputs_schema: { properties: {} }

  # ── Users / marketplace apps ──────────────────────────────────────────────
  - id: get_service_users
    name: sentinelone-get-service-users
    description: "List service users (API token accounts)."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        role_ids: { type: string, description: "Comma-separated RBAC role IDs." }
        ids: { type: string, description: "Comma-separated service-user IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }

  - id: list_installed_singularity_marketplace_applications
    name: sentinelone-list-installed-singularity-marketplace-applications
    description: "List installed Singularity Marketplace applications."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        application_catalog_id: { type: string, description: "Filter by application catalog ID." }
        creator_contains: { type: string, description: "Filter by creator substring." }
        ids: { type: string, description: "Comma-separated application IDs." }
        name_contains: { type: string, description: "Filter by application name substring." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }

  # ── Unified (UAM) alerts ──────────────────────────────────────────────────
  # Console-wide alerts, served by the unifiedalerts GraphQL endpoint rather than
  # the REST v2.1 tree. A different object from the cloud-detection alert of
  # get_alerts: one alert per detection across every surface SentinelOne watches.
  - id: get_unified_alerts
    name: sentinelone-get-unified-alerts
    description: "Retrieve unified (UAM) alerts across endpoint, cloud, identity and third-party surfaces. Walks the cursor until the limit is reached."
    risk: read
    inputs_schema:
      properties:
        created_after: { type: string, description: "Return alerts created at or after this time (ISO8601 or epoch). The incremental field: leave empty and let the alert rule set it." }
        created_until: { type: string, description: "Return alerts created at or before this time (ISO8601, epoch, or a window like '24 hours')." }
        updated_after: { type: string, description: "Return alerts updated at or after this time. Set, it sorts on updatedAt instead of createdAt — use it to pick up alerts retriaged in the console, not to create incidents." }
        view_type: { type: string, description: "Surface to read: ALL (default) | CLOUD | CUSTOM_ALERTS | ENDPOINT | IDENTITY | STAR | THIRD_PARTY" }
        analytics_category: { type: string, description: "Filter on the detecting analytic's category, as the console spells it, e.g. 'Platform Rule' (analyticsCategory=Platform Rule) or 'STAR Rule'. Comma-separated for several. Left empty, every category is returned." }
        classification: { type: string, description: "Comma-separated classifications, e.g. MALWARE,RANSOMWARE,TROJAN." }
        attack_surface: { type: string, description: "Comma-separated attack surfaces: ENDPOINT,CLOUD,IDENTITY,NETWORK,EMAIL." }
        os_type: { type: string, description: "Comma-separated OS types of the affected asset: WINDOWS,LINUX,MACOS." }
        account_ids: { type: string, description: "Optional comma-separated account IDs to scope the fetch to, for a multi-tenant console. Matched against the account the alert is scoped to now, or the one it was detected in." }
        asset_id: { type: string, description: "Only alerts on this asset (comma-separated for several)." }
        external_id: { type: string, description: "Filter on the source's own alert ID (comma-separated for several)." }
        search_text: { type: string, description: "Free-text match on the alert name." }
        unassigned_only: { type: string, description: "true to return only the alerts with no assignee." }
        unmitigated_only: { type: string, description: "true to return only the alerts whose result is UNMITIGATED." }
        detected_after: { type: string, description: "Lower bound on detectedAt (ISO8601, epoch, or a window like '24 hours'). Detection time, as opposed to the console's ingestion time used by created_after." }
        detected_until: { type: string, description: "Upper bound on detectedAt." }
        status: { type: string, description: "Filter on alert status, e.g. NEW | IN_PROGRESS | RESOLVED. Comma-separated for several." }
        severity: { type: string, description: "Filter on severity: CRITICAL | HIGH | MEDIUM | LOW | INFO. Comma-separated for several." }
        analyst_verdict: { type: string, description: "Filter on analyst verdict, e.g. TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED. Comma-separated for several." }
        alert_id: { type: string, description: "Fetch one alert by its UUID." }
        with_details: { type: boolean, description: "Also read each alert's detail (indicators and their MITRE ATT&CK mapping, observables, related alerts, process user) and merge it into the alert. Costs one extra request per 10 alerts; leave off for a plain list fetch." }
        limit: { type: number, description: "Max alerts to return across pages (default 100)." }
        cursor: { type: string, description: "Resume from a previous run's pagination.endCursor." }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
      incremental_field: created_after

  - id: get_unified_alert_details
    name: sentinelone-get-unified-alert-details
    description: "Full detail of one unified (UAM) alert: indicators and their MITRE ATT&CK mapping, observables, and the related alerts."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
      required: [alert_id]
    outputs_schema: { properties: {} }

  - id: update_uam_alert_status
    name: sentinelone-update-uam-alert-status
    description: "Update the status of a unified (UAM) alert."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        status: { type: string, description: "NEW | IN_PROGRESS | RESOLVED" }
      required: [alert_id, status]
    outputs_schema: { properties: {} }

  - id: update_uam_alert_verdict
    name: sentinelone-update-uam-alert-verdict
    description: "Update the analyst verdict of a unified (UAM) alert."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        analyst_verdict: { type: string, description: "Verdict enum, e.g. TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED." }
      required: [alert_id, analyst_verdict]
    outputs_schema: { properties: {} }

  - id: update_uam_alert_assignee
    name: sentinelone-update-uam-alert-assignee
    description: "Assign a unified (UAM) alert to a console user."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        assignee_user_id: { type: string, description: "Console user ID to assign the alert to (the userId returned in assignee.userId)." }
        action_id: { type: string, description: "Console action ID, only if this tenant names it something other than S1/alert/assignUser." }
      required: [alert_id, assignee_user_id]
    outputs_schema: { properties: {} }

  - id: add_uam_alert_note
    name: sentinelone-add-uam-alert-note
    description: "Add an analyst note to a unified (UAM) alert. For the REST threat object, use sentinelone-write-threat-note instead."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        note_text: { type: string, description: "Note content." }
      required: [alert_id, note_text]
    outputs_schema: { properties: {} }

  - id: trigger_uam_alert_action
    name: sentinelone-trigger-uam-alert-action
    description: "Trigger any console action on a unified (UAM) alert — quarantine, kill, remediate, blocklist — by its action ID."
    risk: destructive
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        action_id: { type: string, description: "Console action ID, e.g. S1/alert/quarantine. The action IDs an alert offers are listed in the console." }
        action_type: { type: string, description: "Action type when the action takes one: QUARANTINE, UNQUARANTINE, KILL, REMEDIATE, BLOCKLIST_ADD, EXCLUSION_ADD." }
        payload_json: { type: string, description: "Extra payload as a JSON object, for the actions that take more than a type." }
      required: [alert_id, action_id]
    outputs_schema: { properties: {} }

  # ── PowerQuery (Singularity Data Lake) ────────────────────────────────────
  - id: run_powerquery
    name: sentinelone-run-powerquery
    description: "Run a PowerQuery against the Singularity Data Lake (separate XDR URL + Log Read API key)."
    risk: read
    inputs_schema:
      properties:
        singularity_xdr_url: { type: string, description: "Singularity Data Lake XDR URL (https://...)." }
        singularity_xdr_api_key: { type: string, description: "Log Read Access API key." }
        query: { type: string, description: "PowerQuery syntax query." }
        start_time: { type: string, description: "Query start time." }
        end_time: { type: string, description: "Query end time." }
        priority: { type: string, description: "Execution priority (default low)." }
        recurring: { type: boolean, description: "Create a materialized view (default false)." }
        team_emails: { type: string, description: "Comma-separated account emails for cross-team search." }
      required: [singularity_xdr_url, singularity_xdr_api_key, query]
    outputs_schema: { properties: {} }

  # ── Dynamic asset tag rule (XDR) ──────────────────────────────────────────
  - id: create_tag_rule
    name: sentinelone-create-tag-rule
    description: "Create a dynamic asset tag rule (XDR) that tags assets matching a property filter."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Rule name." }
        account_id: { type: string, description: "Account ID the rule belongs to." }
        tag_id: { type: string, description: "Existing tag ID to apply." }
        filter_values: { type: string, description: "Comma-separated values (e.g. SRV-,WEB-)." }
        filter_name: { type: string, description: "Asset property to filter on (default assetName)." }
        filter_operand: { type: string, description: "startsWith | contains | equals | endsWith (default startsWith)." }
        conditions_operand: { type: string, description: "and | or (default or)." }
        scope_type: { type: string, description: "account | site | global (default account)." }
        site_ids: { type: string, description: "Site ID(s); first is used when scope_type=site." }
        status: { type: string, description: "enabled | disabled (default enabled)." }
        description: { type: string, description: "Rule description." }
      required: [name, account_id, tag_id, filter_values]
    outputs_schema: { properties: {} }

  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: sentinelone-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: get_threats
  mapper: get_threats
  default_incident_type: "SentinelOne Threat"