SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Count by Filters

AI-generated

Overview

This node operation counts the number of threats in the SentinelOne Management Console that match specified filter criteria. It is useful for security analysts and administrators who want to quickly assess the volume of threats based on various attributes such as Kubernetes node names, file paths, analyst verdicts, confidence levels, agent IDs, incident statuses, and many other detailed filters. For example, a user can count all unresolved threats with a high confidence level or count threats initiated by a specific user within a certain time range.

Use Case Examples

  1. Count all threats with a confidence level of 'malicious' to prioritize investigation.
  2. Get the count of threats that require a reboot on any endpoint to plan maintenance windows.
  3. Exclude threats with specific analyst verdicts like 'true_positive' or 'suspicious' to focus on unknown threats.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields A collection of optional filters to narrow down the threats counted, including Kubernetes node name, file path, analyst verdicts, confidence levels, agent IDs, incident statuses, and many more detailed filters.
Options Additional request options such as custom request body, headers, query filters, batching, debug mode, pagination settings, and timeout configuration.

Output

JSON

  • count - The total count of threats matching the specified filters.

Dependencies

  • an API key credential for SentinelOne Management Console

Troubleshooting

  • Ensure that the API credentials are correctly configured and have the necessary permissions to access threat data.
  • Verify that the filter parameters are correctly formatted and valid according to the SentinelOne API documentation.
  • If pagination is enabled, check that the pagination settings match the API's expected parameters to avoid incomplete results.
  • Enable debug mode to inspect the actual API request and response for troubleshooting.

Links

Discussion