SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Explore → Count Events by Type

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve the count of threat events distributed by type for a specified threat ID. It is useful for security analysts and IT administrators who want to analyze the distribution of different event types related to a specific threat, aiding in threat investigation and response.

Use Case Examples

  1. Count the number of different event types associated with a particular threat to understand its behavior and impact.
  2. Generate a report summarizing event types for a threat to prioritize mitigation actions.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which to count events by type.
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Event Id Filter by a specific process key and its children.
Process Name Like Filter by process name (substring).
Event Types Filter events by type. Example: "events".
Event Sub Types Filter events by sub-type. Example: "PROCESSCREATION".

Output

JSON

  • countByType - Count of threat events distributed by type.
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for each API request (if debug option is enabled).

Dependencies

  • an API key credential for SentinelOne Management Console

Troubleshooting

  • Ensure the Threat Id is valid and accessible with the provided credentials.
  • Check API rate limits and adjust batching or request intervals if necessary.
  • Enable debug option to get detailed request and response information for troubleshooting.

Links

Discussion