Overview

The SentinelOne node's 'Fetch Threat File' operation allows users to fetch a file associated with a specific threat from the SentinelOne Management Console API. This is useful in scenarios where security analysts need to retrieve and analyze files related to detected threats for further investigation or remediation. For example, a user can fetch a malicious file detected on an endpoint to perform offline analysis or share it with a security team.

Use Case Examples

1. Fetch a threat file by specifying the threat ID and retrieving the associated file for analysis.
2. Use the operation to download files linked to threats for forensic investigation.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent for the API request (if debug is enabled)

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the user role has permissions to fetch threat files (Admin, IR Team, SOC).
• Check that the threat ID provided is valid and exists in the SentinelOne system.
• If the request times out, consider increasing the timeout setting in the node options.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne API - Fetch Threat File - Official API documentation for fetching threat files from SentinelOne.