SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Explore → Get Process Event

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve detailed information about a specific process creation event related to a threat. It is useful for security analysts and IT professionals who need to investigate and analyze process events associated with security threats in their environment. For example, it can be used to fetch detailed data about a suspicious process event to understand its behavior and impact.

Use Case Examples

  1. Retrieve detailed information about a specific process event by providing the threat ID and event ID to investigate a potential security incident.
  2. Fetch process creation event details to analyze the behavior of a process involved in a detected threat.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the process event is being retrieved.
Event Id The unique identifier of the specific process event to retrieve.
Add Counts Optional parameter to include counts related to the event.
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.

Output

JSON

  • event - Detailed information about the process event

Dependencies

  • an API key credential for SentinelOne Management Console

Troubleshooting

  • Ensure the Threat Id and Event Id are correctly provided and exist in the SentinelOne system.
  • Check API credentials and permissions to access the threat and event data.
  • If pagination is enabled, verify pagination parameters are correctly set to avoid incomplete data retrieval.

Links

Discussion