riposte-marketplace/integrations/sentinelone/manifest.yaml

id: sentinelone
name: SentinelOne
version: 1.17.2
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
changelog: "1.17.2 — update_uam_alert_assignee reads the alert back after assigning it. A real run came back with the alert under success while the console still showed its previous assignee, and the block passed: the mutation only says the console accepted the action. The script now reads the alert's assignee for up to seven seconds and fails when it is not the requested user, printing who the console holds instead — an id that is not the console user's shows up there rather than as a green block. The three UAM updates (assignee, status, verdict) also fail when the console lists the alert under failure or skip, or under neither: it answers those with a 200 and no errors, so they read as done updates. 1.17.1 — update_uam_alert_assignee never assigned anything: its mutation declared the action id as String! and the user as ID!, where the console types them ID! and Long, and the console refused it at validation (VariableTypeMismatch) before touching the alert. Both now carry the console's types. The user id goes out as a number, and a value that is not the numeric console id — an email, a name — is refused with an error naming assignee_user_id instead of a GraphQL type mismatch. 1.17.0 — The unified-alert OCSF mapper, corrected and completed against a real SentinelOne Identity alert. It read asset.type for the device type, and asset.type is UNKNOWN on every alert whose surface is not the endpoint: a domain controller the same alert called a Server was ingested as an unknown device. asset.category is read first now, with a numeric device.type_id beside it. device.ip took the IPv6 address ahead of the IPv4, so every Windows host carried a link-local fe80:: address nothing can pivot on — and which the indicator extractor mined as an IOC all the same; the v4 address wins and the v6 is kept beside it. The alert's flat file summary was written straight into observables, and an alert with no file — identity, cloud — ended up with one observable whose name and value were both the literal string N/A: the summary now fills file.name, and its hash the file.hashes entry its digest length names, only when the process block did not already describe the file. src_endpoint and dst_endpoint are oriented by the detection instead of by habit: SentinelOne fills detectionTime.attacker only when a party distinct from the asset is involved, so its presence now decides which way the pair points — attacker as the source and the asset as the destination when it is filled, the asset as the source and no destination when it is not. Mapping the attacker to dst_endpoint unconditionally announced a domain controller as the source of the Active Directory enumeration it had in fact suffered. device.* is the invariant across both branches, and the asset's full OS version moved onto it, its cloud classifier under unmapped, so the flip costs nothing. finding_info.types is a list, as OCSF and the layout generator both expect. The base event had no clock of its own — time, start_time and end_time are set from detectedAt, firstSeenAt and lastSeenAt, so a timeline no longer falls back to the moment Riposte polled. 47 entries added, 97 to 144, covering every one of the 120 fields the query fetches: severity_id and status_id, the console scope's group, the alert as its own metadata.uid, finding_info.product, rule.category, container.orchestrator, the assignee's id, and the detection-time OS name, domain and logged-in user. 23 of them sit under unmapped.* — the Azure image, instance size and resource tags, the console-side IP, the Kubernetes cluster, namespace, node and controller, the agent's connectivity, pending reboot and policy, the ticket and whether a note exists — surfaced for the page instead of being left in the raw payload. Checked by running the platform's own jsonata-go mapping engine over the real Identity alert, over a STAR alert fetched with_details, over an alert naming only the attacker's address, and over a bare alert: no expression errors on any of them, and the process chain, evidences, attacks and observables come out unchanged. 1.16.0 — count_agents takes the three version comparators missing beside the agentVersion__gt it already had: agentVersion__gte, agentVersion__lt and agentVersion__lte. Sent together they bound a range, so a fleet can be counted on a band of builds rather than only above one; alone, __lte or __lt answers what is still to be upgraded to a target build, which __gt could not ask. Each is left out of the query when empty. 1.15.0 — The incident's process-tree block now draws itself for a unified alert. It rendered the chain already, reading actor.process.file.name, but it places itself automatically only on a mapper declaring actor.process.name next to the parent's, which this one did not — so a generated layout left the block out and the chain went unseen. Mapping the process name to both, plus certSubject to the node's signer badge. Checked by running the block's own reader over the mapper's output on a real alert: explorer.exe to powershell.exe, with the host, the user, and paths and hashes on both nodes when the fetch ran with_details. 1.14.0 — OCSF mapper corrected against a real STAR alert. Its alert-level observables list was empty while every observable sat under the indicators, so the two are now appended instead of reading the alert level alone — 12 observables where the mapper saw none. The same alert had process.username null while its indicators named the user, and named its parent process without hashing it anywhere else, so actor.user.name, actor.process.parent_process.file.path and its three hashes are read from the indicator observables, with the alert's own field winning when filled in. attacks and relatedAlerts are guarded on $count rather than $exists: that alert carries attacks: null, which exists in JSONata and would have written an empty array. Verified end to end through the scheduler's own jsonata-go build, with and without with_details. 1.13.0 — get_unified_alerts takes with_details, which enriches every alert it returns with what only the per-alert view carries: the indicators behind the detection, their MITRE ATT&CK tactic and technique, the observables, the related alerts and the process user. The list nodes alone were too thin to triage on. Read in aliased batches of ten, so a default-limit fetch costs ten extra requests rather than a hundred, and merged under the list node so the richer list fields win on the fields both carry. Best effort: an alert the console will not detail keeps its list fields and the shortfall is reported in pagination.details, rather than failing a fetch that already succeeded. Off by default — a rule that does not set it sends the same queries as before. The OCSF mapper maps the new fields: evidences, finding_info.attacks, finding_info.related_events, the full observables list and the process user. 1.12.0 — get_unified_alerts takes an account_ids filter, so a multi-tenant console can be ingested one account at a time, as get_threats and get_alerts already allowed. Filtered on the scope the alert sits in now (realTime.scope.account.id), falling back to the scope it was detected in and then to a filter over the fetched alerts, the same ladder as the category; pagination.accountFilter reports which ran. 1.11.0 — Absorbs the SentinelOne SDL package, which covered the same unified (UAM) alerts from a second integration: one console, one instance, one set of credentials. get_unified_alerts gains the SDL filters — classification, attack_surface, os_type, asset_id, external_id, search_text, unassigned_only, unmitigated_only and a detectedAt window — status, severity, analyst_verdict and analytics_category take comma-separated lists, and every time input also reads a relative window ('24 hours'). Three capabilities the SDL package had and this one did not: get_unified_alert_details (indicators, their MITRE mapping, observables, related alerts), add_uam_alert_note and trigger_uam_alert_action (any console action by ID). update_uam_alert_assignee completes the status/verdict pair. update_uam_alert_status and _verdict now report a GraphQL error instead of printing it as a successful update. analytics_category filters the fetch to one analytic category, e.g. only the platform-rule alerts (analyticsCategory=Platform Rule, the console's own filter): sent as a server-side filter under either fieldId spelling, and applied to the fetched alerts if the console rejects both, rather than failing the fetch — pagination.categoryFilter reports which ran. The sort argument is likewise tried in both spellings. 1.9.0 — Every command now declares its risk tier, so the agent approval gate can tell a lookup from an action. Only test_connection and get_unified_alerts did; the other 83 were unset, and an unset risk is treated as destructive, which put get-threats and get-alerts behind the same gate as isolate-agent and run-remote-script. 39 read, 22 safe_write, 24 destructive. Destructive covers what removes detection or protection (exclusions, disabling or editing a STAR rule), what adds blocking (blocklist, firewall rule), what changes containment in either direction (isolate and reconnect both), what reboots or shuts a host down, and every delete. 1.8.0 — get_unified_alerts fetches the unified (UAM) alerts: the console-wide alert model served by the unifiedalerts GraphQL endpoint, which get_alerts (cloud-detection) does not cover. Walks the cursor to the requested limit, sorts ascending so a truncated run leaves the watermark on the oldest unseen alert, and flattens edges/node to a plain data[] so the alert rule dedups on a top-level id. Ships with an OCSF mapper (74 fields) and a 'SentinelOne Unified Alert' incident type. 1.7.1 — count_agents' isActive filter is a text field again: declared as a boolean it rendered as a checkbox, which has no empty state, so the count could never be asked for both the active and the inactive agents. Left empty the filter is not sent. 1.7.0 — count_agents takes an accountIds filter, so a multi-tenant console can be counted one account at a time. 1.6.0 — count_agents takes an isActive filter, to count the active agents apart from the inactive ones; left unset, the count still covers both. 1.5.0 — count_agents takes four more filters: agentVersion__gt to count the fleet still below a target build, networkStatuses to count only the endpoints in a given connection state, operationalStatesNin to leave states out of the count, and machineTypes to count servers apart from laptops. 1.4.0 — get_threats and get_alerts accept an optional account_ids filter (accountIds), so a multi-tenant console can be scoped to one or more accounts at fetch time. 1.3.0 — Exhaustive OCSF mappers: get_threats (38 fields) and get_alerts (58 fields) now cover device, finding, malware, actor/target process, file, registry, network, indicators and container. 1.2.4 — Re-modelled the OCSF mappers to OCSF actor/target semantics: the initiating process maps to actor.* (actor.process, actor.user), and the process/file acted upon maps to the target (process.*, file.*, user.*). 1.2.3 — Expanded the OCSF mappers (get_threats, get_alerts) with more fields: file hashes (sha1/md5), file ext/size, finding/rule ids, confidence, status, parent process and device/user identity. 1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
category: endpoint

# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
config_schema:
  properties:
    url:
      type: string
      description: SentinelOne console URL, e.g. https://usea1.sentinelone.net
    api_token:
      type: string
      description: API token (console → My User → API Token)
      x-soar-sensitive: true
  required:
    - url
    - api_token

# Documented for reference; the bundled scripts build the header themselves
# (Authorization: ApiToken <token>).
auth:
  - id: apitoken
    type: api_key
    in: header
    name: Authorization
    value_template: "ApiToken {{secret}}"
    secret_field: api_token

commands:
  # ── Enrichment / read ─────────────────────────────────────────────────────
  - id: get_threats
    name: sentinelone-get-threats
    description: List threats/detections matching filters.
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 20)" }
        mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" }
        query: { type: string, description: "Free-text (hash, file, computer name, uuid)" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
        account_ids: { type: string, description: "Optional comma-separated account IDs to scope the search to." }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
      incremental_field: created_after

  - id: list_agents
    name: sentinelone-list-agents
    description: List endpoints (agents) matching filters.
    risk: read
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Substring match on computer name" }
        os_type: { type: string, description: "windows | macos | linux" }
        is_active: { type: boolean, description: "Only active agents" }
        limit: { type: number, description: "Max results (default 50)" }
      required: []
    outputs_schema: { properties: {} }

  - id: get_agent
    name: sentinelone-get-agent
    description: Get details for one or more agents by ID.
    risk: read
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: get_hash_verdict
    name: sentinelone-get-hash-verdict
    description: Reputation verdict for a SHA1 hash.
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA1 hash" }
      required: [hash]
    outputs_schema: { properties: {} }

  # ── Response ──────────────────────────────────────────────────────────────
  - id: isolate_agent
    name: sentinelone-isolate-agent
    description: Disconnect agents from the network.
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: reconnect_agent
    name: sentinelone-reconnect-agent
    description: Reconnect agents to the network.
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: mitigate_threat
    name: sentinelone-mitigate-threat
    description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
    risk: destructive
    inputs_schema:
      properties:
        action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
      required: [action, threat_ids]
    outputs_schema: { properties: {} }

  - id: initiate_scan
    name: sentinelone-initiate-scan
    description: Start a full disk scan on agents.
    risk: safe_write
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: write_threat_note
    name: sentinelone-write-threat-note
    description: Add a note to one or more threats.
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        note: { type: string, description: "Note text" }
      required: [threat_ids, note]
    outputs_schema: { properties: {} }

  # ── Agents: actions & info ────────────────────────────────────────────────
  - id: shutdown_agent
    name: sentinelone-shutdown-agent
    description: "Send a shutdown command to agents matching the filter."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        query: { type: string, description: "Free-text agent match" }
      required: []
    outputs_schema: { properties: {} }
  - id: uninstall_agent
    name: sentinelone-uninstall-agent
    description: "Send an uninstall command to agents matching the filter."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        query: { type: string, description: "Free-text agent match" }
      required: []
    outputs_schema: { properties: {} }
  - id: broadcast_message
    name: sentinelone-broadcast-message
    description: "Broadcast a message to agents matching the filter."
    risk: safe_write
    inputs_schema:
      properties:
        message: { type: string, description: "Message to broadcast to agents" }
        agent_id: { type: string, description: "Comma-separated agent IDs" }
        group_id: { type: string, description: "Comma-separated group IDs" }
        active_agent: { type: boolean, description: "Only target active agents" }
      required: [message]
    outputs_schema: { properties: {} }
  - id: enable_agent
    name: sentinelone-enable-agent
    description: "Enable agents matching the given IDs, optionally rebooting them."
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
        shouldReboot: { type: boolean, description: "Reboot agents after enabling" }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: move_agent
    name: sentinelone-move-agent
    description: "Move agents into the specified group."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "Target group ID" }
        agents_ids: { type: string, description: "Comma-separated agent IDs to move" }
      required: [group_id, agents_ids]
    outputs_schema: { properties: {} }
  - id: count_agents
    name: sentinelone-count-agents
    description: "Count agents matching the given filters."
    risk: read
    inputs_schema:
      properties:
        computer_name: { type: string, description: "Filter by computer name" }
        os_type: { type: string, description: "Filter by OS type" }
        scan_status: { type: string, description: "Filter by scan status" }
        siteIds: { type: string, description: "Comma-separated site IDs" }
        groupIds: { type: string, description: "Comma-separated group IDs" }
        accountIds: { type: string, description: "Comma-separated account IDs, to scope the count to one or more accounts" }
        agentVersion__gt: { type: string, description: "Only agents on a version strictly greater than this one, e.g. 23.4.2.6" }
        agentVersion__gte: { type: string, description: "Only agents on this version or newer, e.g. 23.4.2.6" }
        agentVersion__lt: { type: string, description: "Only agents on a version strictly older than this one, e.g. 23.4.2.6" }
        agentVersion__lte: { type: string, description: "Only agents on this version or older, e.g. 23.4.2.6 — the fleet still to be upgraded to it" }
        networkStatuses: { type: string, description: "Comma-separated network statuses: connected | connecting | disconnected | disconnecting" }
        operationalStatesNin: { type: string, description: "Comma-separated operational states to exclude, e.g. na" }
        machineTypes: { type: string, description: "Comma-separated machine types: desktop | laptop | server | kubernetes node | storage | unknown" }
        isActive: { type: string, description: "true to count only active agents, false for only the inactive ones; leave empty to count both" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_agent_mac
    name: sentinelone-get-agent-mac
    description: "Retrieve network interfaces (IP and MAC) for a single agent."
    risk: read
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent ID" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: get_installed_applications
    name: sentinelone-get-installed-applications
    description: "Retrieve the applications installed on the given agents."
    risk: read
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: manage_tags
    name: sentinelone-manage-tags
    description: "Add, override or remove a tag on the given agents."
    risk: safe_write
    inputs_schema:
      properties:
        tagId: { type: string, description: "Tag ID to apply" }
        agent_ids: { type: string, description: "Comma-separated agent IDs" }
        operation: { type: string, description: "Tag operation: add, override or remove" }
      required: [tagId, agent_ids, operation]
    outputs_schema: { properties: {} }

  # ── Threats & Alerts ──────────────────────────────────────────────────────
  - id: resolve_threat
    name: sentinelone-resolve-threat
    description: "Mark one or more threats as resolved."
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs to resolve." }
      required: [threat_ids]
    outputs_schema: { properties: {} }
  - id: mark_as_threat
    name: sentinelone-mark-as-threat
    description: "Mark detections as a true threat, scoped to a site or the whole tenant."
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs to mark." }
        target_scope: { type: string, description: "Scope of the action: site or tenant." }
      required: [threat_ids, target_scope]
    outputs_schema: { properties: {} }
  - id: update_threats_verdict
    name: sentinelone-update-threats-verdict
    description: "Set the analyst verdict on one or more threats."
    risk: safe_write
    inputs_schema:
      properties:
        verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
        threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
      required: [verdict, threat_ids]
    outputs_schema: { properties: {} }
  - id: update_threats_status
    name: sentinelone-update-threats-status
    description: "Set the incident status on one or more threats."
    risk: safe_write
    inputs_schema:
      properties:
        status: { type: string, description: "in_progress, resolved, or unresolved." }
        threat_ids: { type: string, description: "Comma-separated threat IDs to update." }
      required: [status, threat_ids]
    outputs_schema: { properties: {} }
  - id: get_threat_notes
    name: sentinelone-get-threat-notes
    description: "Retrieve the notes attached to a single threat."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "ID of the threat whose notes to retrieve." }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: get_threat_summary
    name: sentinelone-get-threat-summary
    description: "Retrieve a dashboard threat summary, optionally filtered by site and group."
    risk: read
    inputs_schema:
      properties:
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: fetch_threat_file
    name: sentinelone-fetch-threat-file
    description: "Request the threat file for download, protected by a ZIP password."
    risk: safe_write
    inputs_schema:
      properties:
        threat_id: { type: string, description: "ID of the threat whose file to fetch." }
        password: { type: string, description: "Password used to encrypt the fetched file ZIP." }
      required: [threat_id, password]
    outputs_schema: { properties: {} }
  - id: get_alerts
    name: sentinelone-get-alerts
    description: "Retrieve cloud-detection alerts filtered by creation window and optional criteria."
    risk: read
    inputs_schema:
      properties:
        created_from: { type: string, description: "Return alerts created at or after this timestamp." }
        created_until: { type: string, description: "Return alerts created at or before this timestamp." }
        ruleName: { type: string, description: "Filter by rule name substring." }
        incidentStatus: { type: string, description: "Filter by incident status." }
        analystVerdict: { type: string, description: "Filter by analyst verdict." }
        alert_ids: { type: string, description: "Comma-separated alert IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        account_ids: { type: string, description: "Optional comma-separated account IDs to scope the search to." }
        limit: { type: number, description: "Max results (default 100)." }
      required: [created_from]
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
      incremental_field: created_from
  - id: update_alerts_verdict
    name: sentinelone-update-alerts-verdict
    description: "Set the analyst verdict on one or more cloud-detection alerts."
    risk: safe_write
    inputs_schema:
      properties:
        verdict: { type: string, description: "undefined, true_positive, false_positive, or suspicious." }
        alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
      required: [verdict, alert_ids]
    outputs_schema: { properties: {} }
  - id: update_alerts_status
    name: sentinelone-update-alerts-status
    description: "Set the incident status on one or more cloud-detection alerts."
    risk: safe_write
    inputs_schema:
      properties:
        status: { type: string, description: "in_progress, resolved, or unresolved." }
        alert_ids: { type: string, description: "Comma-separated alert IDs to update." }
      required: [status, alert_ids]
    outputs_schema: { properties: {} }

  # ── Hash, blocklist, exclusions, IOCs ─────────────────────────────────────
  - id: get_blocklist
    name: sentinelone-get-blocklist
    description: "Retrieve hash blocklist (restriction) entries, optionally filtered by hash, scope, and pagination."
    risk: read
    inputs_schema:
      properties:
        global: { type: boolean, description: "Query the global (tenant) scope. Defaults to true." }
        hash: { type: string, description: "Filter by hash value substring." }
        offset: { type: number, description: "Records to skip for pagination." }
        limit: { type: number, description: "Max records to return (default 100)." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: add_hash_to_blocklist
    name: sentinelone-add-hash-to-blocklist
    description: "Add a SHA1 or SHA256 hash to the blocklist for the given scope."
    risk: destructive
    inputs_schema:
      properties:
        os_type: { type: string, description: "Target OS type: windows, linux, or macos." }
        sha1: { type: string, description: "SHA1 hash (used if sha256 not provided)." }
        sha256: { type: string, description: "SHA256 hash (takes precedence over sha1)." }
        description: { type: string, description: "Optional description." }
        source: { type: string, description: "Source label (defaults to Riposte)." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
      required: [os_type]
    outputs_schema: { properties: {} }
  - id: remove_hash_from_blocklist
    name: sentinelone-remove-hash-from-blocklist
    description: "Find blocklist entries matching a SHA1 hash and delete them."
    risk: destructive
    inputs_schema:
      properties:
        sha1: { type: string, description: "SHA1 hash to remove." }
        os_type: { type: string, description: "Optional OS type filter." }
      required: [sha1]
    outputs_schema: { properties: {} }
  - id: get_white_list
    name: sentinelone-get-white-list
    description: "Retrieve exclusion items, optionally filtered by IDs, type, OS, and scope."
    risk: read
    inputs_schema:
      properties:
        item_ids: { type: string, description: "Comma-separated exclusion item IDs." }
        os_types: { type: string, description: "Filter by OS types." }
        exclusion_type: { type: string, description: "Filter by exclusion type." }
        limit: { type: number, description: "Max records (default 10)." }
        include_parent: { type: boolean, description: "Include parent-scope exclusions." }
        include_children: { type: boolean, description: "Include child-scope exclusions." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: create_white_list_item
    name: sentinelone-create-white-list-item
    description: "Create an exclusion (whitelist) item of the given type and value."
    risk: destructive
    inputs_schema:
      properties:
        exclusion_type: { type: string, description: "Exclusion type (path, white_hash, certificate, browser, file_type)." }
        exclusion_value: { type: string, description: "The value to exclude." }
        os_type: { type: string, description: "Target OS type." }
        description: { type: string, description: "Optional description." }
        exclusion_mode: { type: string, description: "Optional exclusion mode." }
        path_exclusion_type: { type: string, description: "Optional path exclusion type." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
      required: [exclusion_type, exclusion_value, os_type]
    outputs_schema: { properties: {} }
  - id: remove_item_from_whitelist
    name: sentinelone-remove-item-from-whitelist
    description: "Find exclusion items matching a value and delete them."
    risk: destructive
    inputs_schema:
      properties:
        item: { type: string, description: "The exclusion value to find and remove." }
        os_type: { type: string, description: "Optional OS type filter." }
        exclusion_type: { type: string, description: "Optional exclusion type filter." }
      required: [item]
    outputs_schema: { properties: {} }
  - id: delete_exclusion
    name: sentinelone-delete-exclusion
    description: "Delete exclusion items by their IDs and type."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated exclusion item IDs to delete." }
        type: { type: string, description: "Exclusion type of the items being deleted." }
      required: [ids, type]
    outputs_schema: { properties: {} }
  - id: create_ioc
    name: sentinelone-create-ioc
    description: "Create a threat-intelligence IOC for the given account scope."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Name of the IOC." }
        source: { type: string, description: "Source of the IOC." }
        type: { type: string, description: "IOC type: DNS, IPV4, IPV6, MD5, SHA1, SHA256, or URL." }
        method: { type: string, description: "Comparison method (e.g. EQUALS)." }
        validUntil: { type: string, description: "Expiration timestamp (ISO 8601)." }
        value: { type: string, description: "The IOC value." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        externalId: { type: string, description: "Optional external identifier." }
        description: { type: string, description: "Optional description." }
      required: [name, source, type, method, validUntil, value, account_ids]
    outputs_schema: { properties: {} }
  - id: delete_ioc
    name: sentinelone-delete-ioc
    description: "Delete threat-intelligence IOCs by UUID within the given account scope."
    risk: destructive
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        uuids: { type: string, description: "Comma-separated IOC UUIDs to delete." }
      required: [account_ids, uuids]
    outputs_schema: { properties: {} }
  - id: get_iocs
    name: sentinelone-get-iocs
    description: "Retrieve threat-intelligence IOCs, optionally filtered by type, value, source, and name."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max records (default 1000)." }
        type: { type: string, description: "Filter by IOC type." }
        value: { type: string, description: "Filter by IOC value." }
        source: { type: string, description: "Filter by IOC source." }
        name_contains: { type: string, description: "Filter by IOC name substring." }
      required: [account_ids]
    outputs_schema: { properties: {} }

  # ── Sites, groups, accounts, users, Deep Visibility ───────────────────────
  - id: get_activities
    name: sentinelone-get-activities
    description: "Retrieve activities, optionally filtered by date, agents, or threats."
    risk: read
    inputs_schema:
      properties:
        created_after: { type: string, description: "Activities created after this timestamp." }
        limit: { type: number, description: "Max results (default 50)." }
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
        threats_ids: { type: string, description: "Comma-separated threat IDs." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_groups
    name: sentinelone-get-groups
    description: "List groups with optional filters."
    risk: read
    inputs_schema:
      properties:
        group_type: { type: string, description: "Group type (static, dynamic)." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        is_default: { type: boolean, description: "Filter for default groups only." }
        name: { type: string, description: "Exact group name." }
        query: { type: string, description: "Free-text search." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }
  - id: delete_group
    name: sentinelone-delete-group
    description: "Delete a group by its ID."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "ID of the group to delete." }
      required: [group_id]
    outputs_schema: { properties: {} }
  - id: get_sites
    name: sentinelone-get-sites
    description: "List sites with optional filters."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Free-text search." }
        state: { type: string, description: "Site state (active, expired)." }
        site_type: { type: string, description: "Site type." }
        site_name: { type: string, description: "Exact site name." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_site
    name: sentinelone-get-site
    description: "Retrieve a single site by its ID."
    risk: read
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: reactivate_site
    name: sentinelone-reactivate-site
    description: "Reactivate an expired site."
    risk: safe_write
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site to reactivate." }
        unlimited: { type: boolean, description: "Set the site to unlimited duration." }
        expiration: { type: string, description: "New expiration date (ISO 8601)." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: expire_site
    name: sentinelone-expire-site
    description: "Expire a site immediately."
    risk: destructive
    inputs_schema:
      properties:
        site_id: { type: string, description: "ID of the site to expire." }
      required: [site_id]
    outputs_schema: { properties: {} }
  - id: get_accounts
    name: sentinelone-get-accounts
    description: "List all accounts, or retrieve a single account when an ID is provided."
    risk: read
    inputs_schema:
      properties:
        account_id: { type: string, description: "Optional account ID." }
      required: []
    outputs_schema: { properties: {} }
  - id: list_users
    name: sentinelone-list-users
    description: "List users, optionally filtered by account IDs."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }
  - id: delete_user
    name: sentinelone-delete-user
    description: "Delete a user by their ID."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "ID of the user to delete." }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: create_query
    name: sentinelone-create-query
    description: "Initialize a Deep Visibility query over a given time range."
    risk: safe_write
    inputs_schema:
      properties:
        query: { type: string, description: "Deep Visibility query string." }
        from_date: { type: string, description: "Start of the time range (ISO 8601)." }
        to_date: { type: string, description: "End of the time range (ISO 8601)." }
      required: [query, from_date, to_date]
    outputs_schema: { properties: {} }
  - id: get_dv_query_status
    name: sentinelone-get-dv-query-status
    description: "Get the status of a Deep Visibility query by ID."
    risk: read
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
      required: [query_id]
    outputs_schema: { properties: {} }
  - id: get_events
    name: sentinelone-get-events
    description: "Retrieve events for a completed Deep Visibility query."
    risk: read
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
        limit: { type: number, description: "Max events (default 50)." }
        cursor: { type: string, description: "Pagination cursor." }
      required: [query_id]
    outputs_schema: { properties: {} }
  - id: get_processes
    name: sentinelone-get-processes
    description: "Retrieve process events for a completed Deep Visibility query."
    risk: read
    inputs_schema:
      properties:
        query_id: { type: string, description: "ID of the Deep Visibility query." }
        limit: { type: number, description: "Max process events (default 50)." }
      required: [query_id]
    outputs_schema: { properties: {} }

  # ── STAR rules & advanced (remote scripts, tags, firewall, discovery) ──────
  - id: create_star_rule
    name: sentinelone-create-star-rule
    description: "Create a STAR custom detection rule in Draft status."
    risk: destructive
    inputs_schema:
      properties:
        name: { type: string, description: "Rule name." }
        query: { type: string, description: "S1QL detection query." }
        rule_severity: { type: string, description: "Low | Medium | High | Critical." }
        expiration_mode: { type: string, description: "Permanent | Temporary." }
        query_type: { type: string, description: "Query type (defaults to events)." }
        network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
        treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
        description: { type: string, description: "Rule description." }
        expiration_date: { type: string, description: "Expiration date (when Temporary)." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: [name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
    outputs_schema: { properties: {} }
  - id: get_star_rules
    name: sentinelone-get-star-rules
    description: "List STAR custom detection rules."
    risk: read
    inputs_schema:
      properties:
        status: { type: string, description: "Filter by rule status." }
        queryType: { type: string, description: "Filter by query type." }
        name_contains: { type: string, description: "Filter by name substring." }
        ruleIds: { type: string, description: "Comma-separated rule IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 1000)." }
      required: []
    outputs_schema: { properties: {} }
  - id: update_star_rule
    name: sentinelone-update-star-rule
    description: "Update an existing STAR custom detection rule by ID."
    risk: destructive
    inputs_schema:
      properties:
        rule_id: { type: string, description: "ID of the rule to update." }
        name: { type: string, description: "Rule name." }
        query: { type: string, description: "S1QL detection query." }
        rule_severity: { type: string, description: "Low | Medium | High | Critical." }
        expiration_mode: { type: string, description: "Permanent | Temporary." }
        query_type: { type: string, description: "Query type (defaults to events)." }
        network_quarantine: { type: boolean, description: "Network-quarantine matching endpoints." }
        treatAsThreat: { type: string, description: "Malicious | Suspicious | UNDEFINED." }
        description: { type: string, description: "Rule description." }
        expiration_date: { type: string, description: "Expiration date (when Temporary)." }
        query_lang: { type: string, description: "Query language version." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        group_ids: { type: string, description: "Comma-separated group IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
      required: [rule_id, name, query, rule_severity, expiration_mode, network_quarantine, treatAsThreat]
    outputs_schema: { properties: {} }
  - id: enable_star_rules
    name: sentinelone-enable-star-rules
    description: "Enable one or more STAR custom detection rules by ID."
    risk: safe_write
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to enable." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: disable_star_rules
    name: sentinelone-disable-star-rules
    description: "Disable one or more STAR custom detection rules by ID."
    risk: destructive
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to disable." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: delete_star_rule
    name: sentinelone-delete-star-rule
    description: "Delete one or more STAR custom detection rules by ID."
    risk: destructive
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated rule IDs to delete." }
      required: [rule_ids]
    outputs_schema: { properties: {} }
  - id: run_remote_script
    name: sentinelone-run-remote-script
    description: "Execute a remote script (RSO) on the targeted agents."
    risk: destructive
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        script_id: { type: string, description: "ID of the remote script to run." }
        output_destination: { type: string, description: "Where script output is sent." }
        task_description: { type: string, description: "Description of the task." }
        agent_ids: { type: string, description: "Comma-separated agent IDs to target." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        input_params: { type: string, description: "Input parameters passed to the script." }
        password: { type: string, description: "Password for protected scripts." }
        requires_approval: { type: boolean, description: "Whether execution requires approval." }
      required: [account_ids, script_id, output_destination, task_description]
    outputs_schema: { properties: {} }
  - id: create_endpoint_tag
    name: sentinelone-create-endpoint-tag
    description: "Create an endpoint tag in the tag manager."
    risk: safe_write
    inputs_schema:
      properties:
        type: { type: string, description: "Tag type." }
        key: { type: string, description: "Tag key." }
        value: { type: string, description: "Tag value." }
        description: { type: string, description: "Tag description." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        tenant: { type: boolean, description: "Apply at tenant scope." }
      required: [type, key]
    outputs_schema: { properties: {} }
  - id: delete_endpoint_tag
    name: sentinelone-delete-endpoint-tag
    description: "Delete endpoint tags matching the given scope filter."
    risk: destructive
    inputs_schema:
      properties:
        siteIds: { type: string, description: "Comma-separated site IDs." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        query: { type: string, description: "Free-text query filter." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_endpoint_tags
    name: sentinelone-get-endpoint-tags
    description: "List endpoint tags, optionally filtered by key or value substring."
    risk: read
    inputs_schema:
      properties:
        key__contains: { type: string, description: "Filter by key substring." }
        value__contains: { type: string, description: "Filter by value substring." }
      required: []
    outputs_schema: { properties: {} }
  - id: create_firewall_rule
    name: sentinelone-create-firewall-rule
    description: "Create a firewall control rule scoped to an account or site."
    risk: destructive
    inputs_schema:
      properties:
        action: { type: string, description: "Allow | Block." }
        name: { type: string, description: "Rule name." }
        status: { type: string, description: "Enabled | Disabled." }
        description: { type: string, description: "Rule description." }
        direction: { type: string, description: "incoming | outgoing | any." }
        filter_type: { type: string, description: "Scope filter type: accountIds | siteIds." }
        filter_id: { type: string, description: "ID for the chosen scope filter type." }
        remote_host: { type: string, description: "Comma-separated remote host addresses." }
      required: [action, name, status, description, direction, filter_type, filter_id]
    outputs_schema: { properties: {} }
  - id: get_network_discovery_table
    name: sentinelone-get-network-discovery-table
    description: "Retrieve the Ranger network discovery table view."
    risk: read
    inputs_schema:
      properties:
        hostnames__contains: { type: string, description: "Filter by hostname substring." }
        externalIp: { type: string, description: "Filter by exact external IP." }
        externalIp__contains: { type: string, description: "Filter by external IP substring." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_network_discovery_assets
    name: sentinelone-get-network-discovery-assets
    description: "Retrieve XDR network discovery surface assets."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 50)." }
        account_id: { type: string, description: "Account ID filter." }
        site_id: { type: string, description: "Site ID filter." }
        hostname: { type: string, description: "Filter by name substring." }
        epp_status: { type: string, description: "Filter by EPP unsupported/unknown status." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_shadow_assets
    name: sentinelone-get-shadow-assets
    description: "Retrieve XDR shadow assets with optional coverage filters."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max results (default 50)." }
        account_id: { type: string, description: "Account ID filter." }
        site_id: { type: string, description: "Site ID filter." }
        name: { type: string, description: "Filter by name substring." }
        active_coverage: { type: string, description: "Filter by active coverage." }
        missing_coverage: { type: string, description: "Filter by missing coverage." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_gateways
    name: sentinelone-get-gateways
    description: "List Ranger gateways."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: purge_crash_dumps
    name: sentinelone-purge-crash-dumps
    description: "Purge agent crash dumps for the specified agents."
    risk: destructive
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
      required: [agent_ids]
    outputs_schema: { properties: {} }
  - id: list_endpoints_with_application
    name: sentinelone-list-endpoints-with-application
    description: "List the application inventory across endpoints."
    risk: read
    inputs_schema:
      properties:
        groupIds: { type: string, description: "Comma-separated group IDs." }
        name__contains: { type: string, description: "Filter by application name substring." }
        osTypes: { type: string, description: "Filter by OS types." }
        vendor__contains: { type: string, description: "Filter by vendor substring." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 10)." }
      required: []
    outputs_schema: { properties: {} }
  - id: get_app_inventory_endpoints
    name: sentinelone-get-app-inventory-endpoints
    description: "List endpoints that have a given application installed."
    risk: read
    inputs_schema:
      properties:
        applicationName: { type: string, description: "Application name filter." }
        applicationVendor: { type: string, description: "Application vendor filter." }
        siteIds: { type: string, description: "Comma-separated site IDs." }
        groupIds: { type: string, description: "Comma-separated group IDs." }
        accountIds: { type: string, description: "Comma-separated account IDs." }
        cursor: { type: string, description: "Pagination cursor." }
        limit: { type: number, description: "Max results (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  # ── Threat analysis / sample ──────────────────────────────────────────────
  - id: threat_analysis
    name: sentinelone-threat-analysis
    description: "Return the detailed analysis for a threat (agent, detection and threat info)."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat ID." }
      required: [threat_id]
    outputs_schema: { properties: {} }

  - id: threat_download_from_cloud
    name: sentinelone-threat-download-from-cloud
    description: "Get a download URL for a threat's sample from the cloud (BinaryVault)."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat ID." }
      required: [threat_id]
    outputs_schema: { properties: {} }

  # ── Endpoint actions ──────────────────────────────────────────────────────
  - id: abort_endpoint_scan
    name: sentinelone-abort-endpoint-scan
    description: "Abort the disk scan on the given agents."
    risk: safe_write
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: endpoint_fetch_logs
    name: sentinelone-endpoint-fetch-logs
    description: "Fetch agent/endpoint logs from the given agents."
    risk: safe_write
    inputs_schema:
      properties:
        agent_ids: { type: string, description: "Comma-separated agent IDs." }
        agents_logs: { type: boolean, description: "Fetch agent logs (default true)." }
        customer_facing_logs: { type: boolean, description: "Fetch customer-facing logs (default false)." }
        platform_logs: { type: boolean, description: "Fetch platform logs (default false)." }
      required: [agent_ids]
    outputs_schema: { properties: {} }

  - id: fetch_file
    name: sentinelone-fetch-file
    description: "Request a file fetch from an agent endpoint (collected as a password-protected zip)."
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent ID." }
        file_path: { type: string, description: "Absolute file path on the endpoint." }
        password: { type: string, description: "Password to protect the resulting zip." }
      required: [agent_id, file_path, password]
    outputs_schema: { properties: {} }

  # ── Remote scripts (status / results) ─────────────────────────────────────
  - id: get_remote_script_task_status
    name: sentinelone-get-remote-script-task-status
    description: "Get the status of remote-script tasks for a parent task."
    risk: read
    inputs_schema:
      properties:
        parent_task_id: { type: string, description: "Parent task ID." }
        ids: { type: string, description: "Comma-separated task IDs." }
        status: { type: string, description: "Filter by status (e.g. created, completed)." }
        computer_name_contains: { type: string, description: "Filter by computer name substring." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        account_ids: { type: string, description: "Comma-separated account IDs." }
        limit: { type: number, description: "Max results (default 50)." }
      required: [parent_task_id]
    outputs_schema: { properties: {} }

  - id: get_remote_script_task_results
    name: sentinelone-get-remote-script-task-results
    description: "Get download links for the results of remote-script tasks."
    risk: read
    inputs_schema:
      properties:
        task_ids: { type: string, description: "Comma-separated task IDs." }
        computer_names: { type: string, description: "Comma-separated computer names." }
      required: [task_ids]
    outputs_schema: { properties: {} }

  # ── Users / marketplace apps ──────────────────────────────────────────────
  - id: get_service_users
    name: sentinelone-get-service-users
    description: "List service users (API token accounts)."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        role_ids: { type: string, description: "Comma-separated RBAC role IDs." }
        ids: { type: string, description: "Comma-separated service-user IDs." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }

  - id: list_installed_singularity_marketplace_applications
    name: sentinelone-list-installed-singularity-marketplace-applications
    description: "List installed Singularity Marketplace applications."
    risk: read
    inputs_schema:
      properties:
        account_ids: { type: string, description: "Comma-separated account IDs." }
        application_catalog_id: { type: string, description: "Filter by application catalog ID." }
        creator_contains: { type: string, description: "Filter by creator substring." }
        ids: { type: string, description: "Comma-separated application IDs." }
        name_contains: { type: string, description: "Filter by application name substring." }
        site_ids: { type: string, description: "Comma-separated site IDs." }
        limit: { type: number, description: "Max results (default 100)." }
      required: []
    outputs_schema: { properties: {} }

  # ── Unified (UAM) alerts ──────────────────────────────────────────────────
  # Console-wide alerts, served by the unifiedalerts GraphQL endpoint rather than
  # the REST v2.1 tree. A different object from the cloud-detection alert of
  # get_alerts: one alert per detection across every surface SentinelOne watches.
  - id: get_unified_alerts
    name: sentinelone-get-unified-alerts
    description: "Retrieve unified (UAM) alerts across endpoint, cloud, identity and third-party surfaces. Walks the cursor until the limit is reached."
    risk: read
    inputs_schema:
      properties:
        created_after: { type: string, description: "Return alerts created at or after this time (ISO8601 or epoch). The incremental field: leave empty and let the alert rule set it." }
        created_until: { type: string, description: "Return alerts created at or before this time (ISO8601, epoch, or a window like '24 hours')." }
        updated_after: { type: string, description: "Return alerts updated at or after this time. Set, it sorts on updatedAt instead of createdAt — use it to pick up alerts retriaged in the console, not to create incidents." }
        view_type: { type: string, description: "Surface to read: ALL (default) | CLOUD | CUSTOM_ALERTS | ENDPOINT | IDENTITY | STAR | THIRD_PARTY" }
        analytics_category: { type: string, description: "Filter on the detecting analytic's category, as the console spells it, e.g. 'Platform Rule' (analyticsCategory=Platform Rule) or 'STAR Rule'. Comma-separated for several. Left empty, every category is returned." }
        classification: { type: string, description: "Comma-separated classifications, e.g. MALWARE,RANSOMWARE,TROJAN." }
        attack_surface: { type: string, description: "Comma-separated attack surfaces: ENDPOINT,CLOUD,IDENTITY,NETWORK,EMAIL." }
        os_type: { type: string, description: "Comma-separated OS types of the affected asset: WINDOWS,LINUX,MACOS." }
        account_ids: { type: string, description: "Optional comma-separated account IDs to scope the fetch to, for a multi-tenant console. Matched against the account the alert is scoped to now, or the one it was detected in." }
        asset_id: { type: string, description: "Only alerts on this asset (comma-separated for several)." }
        external_id: { type: string, description: "Filter on the source's own alert ID (comma-separated for several)." }
        search_text: { type: string, description: "Free-text match on the alert name." }
        unassigned_only: { type: string, description: "true to return only the alerts with no assignee." }
        unmitigated_only: { type: string, description: "true to return only the alerts whose result is UNMITIGATED." }
        detected_after: { type: string, description: "Lower bound on detectedAt (ISO8601, epoch, or a window like '24 hours'). Detection time, as opposed to the console's ingestion time used by created_after." }
        detected_until: { type: string, description: "Upper bound on detectedAt." }
        status: { type: string, description: "Filter on alert status, e.g. NEW | IN_PROGRESS | RESOLVED. Comma-separated for several." }
        severity: { type: string, description: "Filter on severity: CRITICAL | HIGH | MEDIUM | LOW | INFO. Comma-separated for several." }
        analyst_verdict: { type: string, description: "Filter on analyst verdict, e.g. TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED. Comma-separated for several." }
        alert_id: { type: string, description: "Fetch one alert by its UUID." }
        with_details: { type: boolean, description: "Also read each alert's detail (indicators and their MITRE ATT&CK mapping, observables, related alerts, process user) and merge it into the alert. Costs one extra request per 10 alerts; leave off for a plain list fetch." }
        limit: { type: number, description: "Max alerts to return across pages (default 100)." }
        cursor: { type: string, description: "Resume from a previous run's pagination.endCursor." }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
      incremental_field: created_after

  - id: get_unified_alert_details
    name: sentinelone-get-unified-alert-details
    description: "Full detail of one unified (UAM) alert: indicators and their MITRE ATT&CK mapping, observables, and the related alerts."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
      required: [alert_id]
    outputs_schema: { properties: {} }

  - id: update_uam_alert_status
    name: sentinelone-update-uam-alert-status
    description: "Update the status of a unified (UAM) alert."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        status: { type: string, description: "NEW | IN_PROGRESS | RESOLVED" }
      required: [alert_id, status]
    outputs_schema: { properties: {} }

  - id: update_uam_alert_verdict
    name: sentinelone-update-uam-alert-verdict
    description: "Update the analyst verdict of a unified (UAM) alert."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        analyst_verdict: { type: string, description: "Verdict enum, e.g. TRUE_POSITIVE_MALWARE, FALSE_POSITIVE_BENIGN, UNDEFINED." }
      required: [alert_id, analyst_verdict]
    outputs_schema: { properties: {} }

  - id: update_uam_alert_assignee
    name: sentinelone-update-uam-alert-assignee
    description: "Assign a unified (UAM) alert to a console user."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        assignee_user_id: { type: string, description: "Numeric console user ID to assign the alert to (the userId returned in assignee.userId, or a user's id from the users list)." }
        action_id: { type: string, description: "Console action ID, only if this tenant names it something other than S1/alert/assignUser." }
      required: [alert_id, assignee_user_id]
    outputs_schema: { properties: {} }

  - id: add_uam_alert_note
    name: sentinelone-add-uam-alert-note
    description: "Add an analyst note to a unified (UAM) alert. For the REST threat object, use sentinelone-write-threat-note instead."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        note_text: { type: string, description: "Note content." }
      required: [alert_id, note_text]
    outputs_schema: { properties: {} }

  - id: trigger_uam_alert_action
    name: sentinelone-trigger-uam-alert-action
    description: "Trigger any console action on a unified (UAM) alert — quarantine, kill, remediate, blocklist — by its action ID."
    risk: destructive
    inputs_schema:
      properties:
        alert_id: { type: string, description: "UAM alert ID (UUID)." }
        action_id: { type: string, description: "Console action ID, e.g. S1/alert/quarantine. The action IDs an alert offers are listed in the console." }
        action_type: { type: string, description: "Action type when the action takes one: QUARANTINE, UNQUARANTINE, KILL, REMEDIATE, BLOCKLIST_ADD, EXCLUSION_ADD." }
        payload_json: { type: string, description: "Extra payload as a JSON object, for the actions that take more than a type." }
      required: [alert_id, action_id]
    outputs_schema: { properties: {} }

  # ── PowerQuery (Singularity Data Lake) ────────────────────────────────────
  - id: run_powerquery
    name: sentinelone-run-powerquery
    description: "Run a PowerQuery against the Singularity Data Lake (separate XDR URL + Log Read API key)."
    risk: read
    inputs_schema:
      properties:
        singularity_xdr_url: { type: string, description: "Singularity Data Lake XDR URL (https://...)." }
        singularity_xdr_api_key: { type: string, description: "Log Read Access API key." }
        query: { type: string, description: "PowerQuery syntax query." }
        start_time: { type: string, description: "Query start time." }
        end_time: { type: string, description: "Query end time." }
        priority: { type: string, description: "Execution priority (default low)." }
        recurring: { type: boolean, description: "Create a materialized view (default false)." }
        team_emails: { type: string, description: "Comma-separated account emails for cross-team search." }
      required: [singularity_xdr_url, singularity_xdr_api_key, query]
    outputs_schema: { properties: {} }

  # ── Dynamic asset tag rule (XDR) ──────────────────────────────────────────
  - id: create_tag_rule
    name: sentinelone-create-tag-rule
    description: "Create a dynamic asset tag rule (XDR) that tags assets matching a property filter."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Rule name." }
        account_id: { type: string, description: "Account ID the rule belongs to." }
        tag_id: { type: string, description: "Existing tag ID to apply." }
        filter_values: { type: string, description: "Comma-separated values (e.g. SRV-,WEB-)." }
        filter_name: { type: string, description: "Asset property to filter on (default assetName)." }
        filter_operand: { type: string, description: "startsWith | contains | equals | endsWith (default startsWith)." }
        conditions_operand: { type: string, description: "and | or (default or)." }
        scope_type: { type: string, description: "account | site | global (default account)." }
        site_ids: { type: string, description: "Site ID(s); first is used when scope_type=site." }
        status: { type: string, description: "enabled | disabled (default enabled)." }
        description: { type: string, description: "Rule description." }
      required: [name, account_id, tag_id, filter_values]
    outputs_schema: { properties: {} }

  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: sentinelone-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: get_threats
  mapper: get_threats
  default_incident_type: "SentinelOne Threat"