SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Auto Complete

AI-generated

Overview

This node operation performs an auto-complete search on threat filters in the SentinelOne Management Console API. It is useful for retrieving suggested values for specific filter fields related to threats, helping users to quickly find and select valid filter options when querying threat data. For example, it can be used to get auto-complete suggestions for Kubernetes node names, file paths, analyst verdicts, confidence levels, and other threat-related attributes.

Use Case Examples

  1. A security analyst wants to filter threats by Kubernetes node names but is unsure of the exact names. Using this node's auto-complete operation, they can get suggested node names based on partial input.
  2. An automation workflow needs to exclude threats with specific analyst verdicts. The node can provide auto-complete suggestions for valid verdicts to use in the filter.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields Optional filters to refine the auto-complete suggestions, such as Kubernetes node name contains, file path contains, analyst verdicts to exclude, confidence levels to exclude, agent IDs, creation and update timestamps, incident statuses to exclude, and many more threat-related filter fields.

Output

JSON

  • json - Array of auto-complete suggestion strings or objects

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the API credentials are valid and have the necessary permissions to access threat data.
  • If the node returns no suggestions, verify that the input text and key parameters are correctly set.
  • Check for network connectivity issues between n8n and the SentinelOne API endpoint.

Links

Discussion