f3nris
a3ac1ee30d
Endpoints derived from the SentinelOne API v2.1. Script-based (urllib, INTEGRATION_SECRETS/INPUTS contract) to express S1's nested filter bodies. Config: console url + api_token (ApiToken header). Commands: - enrich: get_threats, list_agents, get_agent, get_hash_verdict - respond: isolate_agent (disconnect), reconnect_agent (connect), mitigate_threat (kill/quarantine/remediate/rollback), initiate_scan, write_threat_note
124 lines
4.7 KiB
YAML
124 lines
4.7 KiB
YAML
id: sentinelone
|
|
name: SentinelOne
|
|
version: 1.0.0
|
|
description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
|
|
changelog: "1.0.0 — Initial release: threats, agents, hash verdict, isolate/reconnect, mitigate, scan, threat notes."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
|
|
config_schema:
|
|
properties:
|
|
url:
|
|
type: string
|
|
description: SentinelOne console URL, e.g. https://usea1.sentinelone.net
|
|
api_token:
|
|
type: string
|
|
description: API token (console → My User → API Token)
|
|
x-soar-sensitive: true
|
|
required:
|
|
- url
|
|
- api_token
|
|
|
|
# Documented for reference; the bundled scripts build the header themselves
|
|
# (Authorization: ApiToken <token>).
|
|
auth:
|
|
- id: apitoken
|
|
type: api_key
|
|
in: header
|
|
name: Authorization
|
|
value_template: "ApiToken {{secret}}"
|
|
secret_field: api_token
|
|
|
|
commands:
|
|
# ── Enrichment / read ─────────────────────────────────────────────────────
|
|
- id: get_threats
|
|
name: Get threats
|
|
description: List threats/detections matching filters.
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max results (default 20)" }
|
|
mitigation_status: { type: string, description: "mitigated | active | blocked | suspicious | pending" }
|
|
query: { type: string, description: "Free-text (hash, file, computer name, uuid)" }
|
|
threat_ids: { type: string, description: "Comma-separated threat IDs" }
|
|
created_after: { type: string, description: "ISO8601 lower bound on createdAt" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_agents
|
|
name: List agents
|
|
description: List endpoints (agents) matching filters.
|
|
inputs_schema:
|
|
properties:
|
|
computer_name: { type: string, description: "Substring match on computer name" }
|
|
os_type: { type: string, description: "windows | macos | linux" }
|
|
is_active: { type: boolean, description: "Only active agents" }
|
|
limit: { type: number, description: "Max results (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_agent
|
|
name: Get agent
|
|
description: Get details for one or more agents by ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
|
required: [agent_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_hash_verdict
|
|
name: Get hash verdict
|
|
description: Reputation verdict for a SHA1 hash.
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "SHA1 hash" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Response ──────────────────────────────────────────────────────────────
|
|
- id: isolate_agent
|
|
name: Isolate agent (disconnect)
|
|
description: Disconnect agents from the network.
|
|
inputs_schema:
|
|
properties:
|
|
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
|
required: [agent_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: reconnect_agent
|
|
name: Reconnect agent
|
|
description: Reconnect agents to the network.
|
|
inputs_schema:
|
|
properties:
|
|
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
|
required: [agent_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: mitigate_threat
|
|
name: Mitigate threat
|
|
description: Apply a mitigation action to threats (kill, quarantine, remediate, rollback).
|
|
inputs_schema:
|
|
properties:
|
|
action: { type: string, description: "kill | quarantine | un-quarantine | remediate | rollback-remediation" }
|
|
threat_ids: { type: string, description: "Comma-separated threat IDs" }
|
|
required: [action, threat_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: initiate_scan
|
|
name: Initiate endpoint scan
|
|
description: Start a full disk scan on agents.
|
|
inputs_schema:
|
|
properties:
|
|
agent_ids: { type: string, description: "Comma-separated agent IDs" }
|
|
required: [agent_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: write_threat_note
|
|
name: Add threat note
|
|
description: Add a note to one or more threats.
|
|
inputs_schema:
|
|
properties:
|
|
threat_ids: { type: string, description: "Comma-separated threat IDs" }
|
|
note: { type: string, description: "Note text" }
|
|
required: [threat_ids, note]
|
|
outputs_schema: { properties: {} }
|