Overview

This node interacts with the SentinelOne Management Console API to retrieve exclusion options for a specific threat. It is useful for security analysts and administrators who want to understand the types of exclusions that can be created based on the detection data of a threat, such as file path or file hash exclusions. For example, after identifying a threat with a specific SHA1 hash, the node can fetch the possible exclusion types to help create precise exclusions and reduce false positives.

Use Case Examples

1. Retrieve exclusion options for a threat by providing its threat ID to determine available exclusion types like path or file hash.
2. Use the node to fetch exclusion options before creating exclusions to ensure they are specific and minimize security risks.

Properties

Output

JSON

• exclusionOptions - List of exclusion types that can be created from the detection data of the threat.
• debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the provided Threat Id is valid and exists in the SentinelOne system.
• Check API credentials and permissions to access threat data and exclusion options.
• If pagination is enabled, verify pagination parameters are correctly set to avoid incomplete data.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne API - Get Exclusion Options - Official API documentation for retrieving exclusion options for a threat.