Overview

This node operation creates a threat alert from a Deep Visibility event that the SentinelOne Agent did not detect as a threat. It is useful for security teams who want to manually mark suspicious activities detected by Deep Visibility as threats to trigger mitigation actions such as rollback or quarantine. This operation requires appropriate permissions (Admin, IR Team, SOC) and a deployment with Deep Visibility enabled (Complete SKU).

Use Case Examples

1. Mark a process that encrypts files as a threat to initiate rollback mitigation.
2. Create a threat alert from a Deep Visibility event to enhance endpoint protection.

Properties

Output

JSON

• json
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the user role has threat action permissions (Admin, IR Team, SOC).
• Verify that the deployment has Deep Visibility enabled (Complete SKU).
• Check that the input properties for the Deep Visibility event are correctly formatted and case-sensitive.
• If the API request fails, enable debug mode to see the request details and troubleshoot the issue.

Links

• SentinelOne Deep Visibility Documentation - Official documentation for Deep Visibility feature in SentinelOne.