Overview

This node interacts with the SentinelOne Management Console API to add threats to a blacklist. It is useful for security teams who want to block specific threats identified by their SHA1 hash across different scopes such as Global, Account, Site, or Group. The node supports batch processing, custom request bodies, headers, query filters, and pagination to handle large datasets efficiently. It also offers a debug mode to troubleshoot API requests by outputting detailed request information.

Use Case Examples

1. Automatically add newly detected malicious threats to the blacklist to prevent execution on endpoints.
2. Batch process a list of threat hashes to update the blacklist across multiple accounts or sites.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request, available when debug mode is enabled.

Dependencies

• An API key credential for SentinelOne Management Console API authentication.

Troubleshooting

• Ensure the API key credential is correctly configured and has the necessary permissions to modify the blacklist.
• Check that the SHA1 hashes provided are valid and correspond to actual threats.
• If using batching, verify batch size and interval settings to avoid hitting API rate limits.
• Enable debug mode to inspect the exact API request and response for troubleshooting.
• Handle API errors gracefully and check for permission or scope-related issues in the SentinelOne console.

Links

• SentinelOne API Documentation - Add to Blacklist - Official API documentation for adding threats to the blacklist in SentinelOne.