SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Create Slim Threat

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to create a slim threat alert. It is designed for scenarios where minimal data about a file or process, which the Agent did not detect as malicious, needs to be reported as a threat alert. This operation is typically used by support teams or advanced users who have access to specific data required for creating such alerts.

Use Case Examples

  1. Creating a slim threat alert from minimal file or process data that was not automatically detected by the SentinelOne Agent.
  2. Reporting a suspicious file or process manually to the SentinelOne Management Console for further analysis.

Properties

Name Meaning
Options Additional options for the API request, including custom body JSON, custom HTTP headers, query-string filters, batching settings, debug mode, pagination settings, and request timeout.

Output

JSON

  • json
    • debug - Debug information including URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

  • An API key credential for SentinelOne API authentication.

Troubleshooting

  • Ensure the API credentials are correctly configured and have the necessary permissions to create slim threats.
  • Check that the input data contains the required minimal information for creating a slim threat.
  • Enable debug mode to get detailed request and response information for troubleshooting.
  • Handle API rate limits by configuring batching and request intervals appropriately.
  • Verify that the SentinelOne Management Console API endpoint is reachable and responsive.

Links

Discussion