SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Notes → Get Threat Notes

AI-generated

Overview

This node retrieves threat notes associated with a specific threat ID from the SentinelOne Management Console API. It supports fetching all notes or a paginated subset, with options to filter and sort the results. This is useful for security analysts or automated workflows that need to review or process notes related to security threats for incident management or auditing purposes.

Use Case Examples

  1. Fetch all notes for a given threat to review analyst comments and updates.
  2. Retrieve a limited number of recent notes sorted by creation date for quick incident assessment.

Properties

Name Meaning
Return All Whether to return all results or only a single page of threat notes.
Threat Id The unique identifier of the threat for which to retrieve notes.
Additional Fields Optional filters and sorting options for the notes, such as sort by column, limit, skip count, sort order, creator name filter, count only flag, cursor for pagination, and creator ID filter.
Options Additional request options including custom request body, custom headers, query filters, batching settings, debug mode, pagination settings, and request timeout.

Output

JSON

  • id - Unique identifier of the threat note.
  • threat_id - Identifier of the associated threat.
  • creator - Name or identifier of the note creator.
  • created_at - Timestamp when the note was created.
  • updated_at - Timestamp when the note was last updated.
  • text - Content of the threat note.

Dependencies

  • An API key credential for SentinelOne Management Console API authentication.

Troubleshooting

  • Ensure the provided threat_id is valid and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat notes.
  • If pagination is enabled, verify pagination parameters are correctly set to avoid incomplete data.
  • Enable debug mode to inspect the actual API request and response for troubleshooting.

Links

Discussion