SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Explore → Get Timeline Limits

AI-generated

Overview

This node operation fetches the timestamp of the first and last events of a threat's attack storyline from the SentinelOne Management Console API. It is useful for security analysts and incident responders who want to understand the timeline boundaries of a specific threat's activity. For example, it can be used to quickly identify the start and end times of an attack for further investigation or reporting.

Use Case Examples

  1. Retrieve the timeline limits for a given threat ID to analyze the attack duration.
  2. Use the timeline limits to correlate threat events with other security logs or alerts.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the timeline limits are requested.
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Options Additional optional parameters such as custom request body, headers, query filters, batching settings, debug mode, pagination settings, and timeout configuration.

Output

JSON

  • timeline
    • firstEventTimestamp - Timestamp of the first event in the threat's attack storyline.
    • lastEventTimestamp - Timestamp of the last event in the threat's attack storyline.

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the provided Threat Id is valid and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat data.
  • If pagination is enabled, verify pagination parameters are correctly set to avoid incomplete data.
  • Enable debug mode to see the actual request and response for troubleshooting.

Links

Discussion