SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Download from cloud

AI-generated

Overview

This node interacts with the SentinelOne API to download threat files from the cloud based on a specified threat ID. It is useful for security analysts or automated workflows that need to retrieve threat-related files for further analysis or archival. For example, a user can input a threat ID to fetch the associated threat file stored in the cloud for investigation or evidence collection.

Use Case Examples

  1. Download a threat file from the cloud by providing the threat ID to analyze malware samples.
  2. Automate the retrieval of threat files for all detected threats in a security incident response workflow.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Threat Id The unique identifier of the threat to download the file from the cloud.
Options Additional optional settings such as custom request body, headers, query filters, batching, debug mode, pagination, and timeout settings.

Output

JSON

  • json - The JSON response containing the downloaded threat file data or metadata.

Dependencies

  • An API key credential for SentinelOne API authentication

Troubleshooting

  • Ensure the provided Threat Id is valid and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat data and download files.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If the node returns empty or incomplete data, enable debug mode to inspect the request and response details.

Links

Discussion