SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Enriched Events

AI-generated

Overview

This node interacts with the SentinelOne API to retrieve enriched threat event data for a specified threat ID. It is useful for security analysts and incident responders who need detailed event information related to a specific threat to perform in-depth analysis and investigation. For example, it can fetch all events associated with a threat, including process creation, file modifications, and network connections, with options to filter and sort the results.

Use Case Examples

  1. Retrieve all enriched events for a given threat ID to analyze the attack timeline.
  2. Filter threat events by event type or process name to focus on specific activities within a threat.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which enriched events are to be retrieved.
Return All Whether to return all results or only a single page of results.
Additional Fields Optional filters and parameters to refine the event data retrieval, such as sorting, limiting the number of results, filtering by event ID, event sub-types, event types, process name, and pagination cursor.

Output

JSON

  • eventId - Unique identifier of the event.
  • eventSubTypes - Sub-types of the event.
  • limit - Limit on the number of returned items.
  • skipCount - Flag indicating if total number of items is calculated.
  • skip - Number of items to skip.
  • sortOrder - Sort direction of the results.
  • eventTypes - Types of events filtered.
  • processName__like - Filter by process name substring.
  • countOnly - Flag indicating if only the count of items is returned.
  • cursor - Cursor for pagination to iterate over more than 1000 items.

Dependencies

  • An API key credential for SentinelOne API authentication.

Troubleshooting

  • Ensure the Threat Id is correctly provided and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat event data.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If pagination is used, ensure correct handling of cursor or offset parameters to retrieve all data.
  • Enable debug option to get detailed request and response information for troubleshooting.

Links

Discussion