Overview

This node operation allows users to add a SHA1 hash from Deep Visibility results to the Blacklist in SentinelOne. It supports setting the scope of the Blacklist to Global, Account, Site, or Group. The operation requires the SHA1 hash and the Agent ID, which can be obtained from Deep Visibility events. This is useful for security teams to block malicious files detected by Deep Visibility across their environment, ensuring that any endpoint with the Agent installed will block the blacklisted threat immediately. The operation requires appropriate permissions (Admin, IR Team, SOC) and the user scope must include the Agent's scope. It also requires the Complete SKU of SentinelOne.

Use Case Examples

1. Automatically add a detected malicious file's SHA1 hash from Deep Visibility events to the global Blacklist to prevent execution on any endpoint.
2. Add a suspicious file's SHA1 hash to the Blacklist scoped to a specific Account or Site to contain the threat within that segment.

Properties

Output

JSON

• json
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne API authentication.

Troubleshooting

• Ensure the user has Admin, IR Team, or SOC role permissions and the user scope includes the Agent's scope to perform Blacklist modifications.
• Verify that the SHA1 hash and Agent ID are correctly obtained from Deep Visibility events before making the request.
• Check that the SentinelOne deployment has the Complete SKU, as Deep Visibility features require it.
• If rate limiting occurs, use batching options to limit request frequency.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne API Documentation - Add to Blacklist Deep Visibility - Official API documentation for adding a SHA1 hash to the Blacklist from Deep Visibility results.