SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Count Events by Type

AI-generated

Overview

This node interacts with the SentinelOne API to retrieve the count of threat events distributed by type for a specified threat ID. It is useful for security analysts and incident responders who want to analyze the distribution of different event types related to a specific threat, helping in threat investigation and response prioritization.

Use Case Examples

  1. Count the number of process creation, file modification, and network connection events associated with a particular threat to understand its behavior.
  2. Retrieve the count of different event types for a threat to generate a summary report for security monitoring.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Threat Id The unique identifier of the threat for which to count events by type.
Additional Fields Optional filters to refine the event count, such as filtering by specific event ID, process name substring, event types, or event sub-types.

Output

JSON

  • countByType - Count of threat events distributed by type

Dependencies

  • an API key credential for SentinelOne API

Troubleshooting

  • Ensure the Threat Id is correctly specified and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat event data.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If pagination is enabled, ensure the pagination parameters are correctly configured to retrieve all data.
  • Review error messages for rate limiting or access denied issues and adjust API usage or permissions accordingly.

Links

Discussion