Overview

This node operation adds a specified threat to the exclusions list in the SentinelOne Management Console. It is useful for security administrators who want to override the 'malicious' verdict of the SentinelOne agent for certain detections, effectively suppressing alerts and mitigation actions for those threats. This can be applied cautiously to reduce false positives or allow benign items that are necessary for interoperability.

Use Case Examples

1. A security admin identifies a false positive threat and uses this operation to add it to the exclusions list, preventing further alerts for that threat.
2. An IT team needs to allow a specific application or file that is mistakenly flagged as malicious, so they add it to exclusions to avoid disruption.

Properties

Output

JSON

• json
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the 'whitening option' required by the API is provided correctly to avoid errors.
• Check API credentials and permissions to confirm the user has rights to add exclusions.
• If rate limits are hit, use batching options to throttle requests.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• Best Practices for Exclusions - Official SentinelOne documentation on best practices when creating exclusions to avoid security risks.
• Not Recommended Exclusions - List of exclusions that are not recommended by SentinelOne due to potential security risks.