SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Explore → Get Tree

AI-generated

Overview

The SentinelOne node's 'Explore - Get Tree' operation retrieves a tree view of threat events for a specified threat ID. This operation is useful for security analysts and incident responders who need to visualize the hierarchical structure of events related to a particular threat, including parent and child events, to understand the threat's context and impact. It supports pagination and filtering options to control the depth and scope of the tree data returned.

Use Case Examples

  1. Visualize the event tree of a specific threat to analyze its propagation and related activities.
  2. Fetch a detailed hierarchical view of threat events including parents and children for incident investigation.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the event tree is retrieved.
Return All Whether to return all results or only a single page. When disabled, pagination parameters are not sent and only one page of results is returned.
Children Depth Depth of children events to include in the tree.
Selected Event Id Specific event ID to select in the tree.
Limit Limit the number of returned items (1-100000).
Skip Number of items to skip (0-100000).
With Parents Flag to show parents of the selected event.
With Parents Children Flag to show children of the selected event's parents.
Fetch All Children Flag to fetch all children events.

Output

JSON

  • json - The tree view data of threat events.

Dependencies

  • an API key credential for SentinelOne API

Troubleshooting

  • Ensure the 'Threat Id' is valid and accessible with the provided credentials.
  • Check API rate limits and adjust batching or request intervals if necessary.
  • Enable debug option to see the actual request and response for troubleshooting.

Links

Discussion