SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Export Threats

AI-generated

Overview

This node operation exports data of threats from the SentinelOne Management Console API that match specified filters. It is useful for security analysts and incident responders who need to extract threat data for reporting, analysis, or integration with other systems. Users can specify various filters such as Kubernetes node name, file path, analyst verdicts, confidence levels, agent IDs, creation and update timestamps, incident statuses, and more to narrow down the threats to export. The operation supports pagination and can return all matching results or a single page.

Use Case Examples

  1. Export all threats with a confidence level of 'malicious' and incident status 'unresolved' for further investigation.
  2. Export threats detected on specific Kubernetes nodes to analyze endpoint security events in a cluster environment.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields Various filters to narrow down the threats to export, such as Kubernetes node name, file path, analyst verdicts, confidence levels, agent IDs, creation and update timestamps, incident statuses, and more.

Output

JSON

  • data - Array of exported threat data objects

Dependencies

  • an API key credential for SentinelOne Management Console

Troubleshooting

  • Ensure the API credentials are correctly configured and have the necessary permissions to access threat export endpoints.
  • Check that the filter parameters are valid and correctly formatted to avoid API errors.
  • If pagination is enabled, verify that the pagination settings match the API's expected parameters to retrieve all data.
  • Enable debug mode to see the actual API request and response details for troubleshooting.

Links

Discussion