SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Explore → Get Enriched Events

AI-generated

Overview

This node interacts with the SentinelOne API to retrieve enriched threat events related to a specific threat ID. It is designed to fetch detailed event data, including various filters and pagination options, which is useful for security analysts and incident responders to investigate and analyze threat activities comprehensively. For example, it can be used to get all events associated with a threat, filter events by type or process name, and handle large datasets with pagination.

Use Case Examples

  1. Retrieve all enriched events for a given threat ID to analyze the attack timeline.
  2. Filter enriched events by process name substring to focus on specific processes related to a threat.
  3. Use pagination to fetch all pages of enriched events for comprehensive threat analysis.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which enriched events are retrieved.
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Sort By The column to sort the results by.
Event Id Filter by a specific process key and its children.
Event Sub Types Filter events by sub-type.
Limit Limit number of returned items (1-1000).
Skip Count If true, total number of items will not be calculated, which speeds up execution time.
Skip Skip first number of items (0-1000). To iterate over more than 1000 items, use "cursor".
Sort Order Sort direction.
Event Types Filter events by type.
Process Name Like Filter by process name (substring).
Count Only If true, only total number of items will be returned, without any of the actual objects.
Cursor Cursor position returned by the last request. Use to iterate over more than 1000 items.

Output

JSON

  • json - The enriched events data returned from the SentinelOne API.

Dependencies

  • an API key credential for SentinelOne

Troubleshooting

  • Ensure the Threat Id is correctly specified and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat data.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If pagination is enabled, ensure correct handling of cursor or offset parameters to retrieve all data.

Links

Discussion