Overview

This node interacts with the SentinelOne API to retrieve threat events related to a specific threat ID. It supports fetching all events or a paginated subset, with various filtering and sorting options. This is useful for security analysts who want to explore detailed event data associated with a threat, such as process creation, file modifications, or network connections, to understand the threat's behavior and impact.

Use Case Examples

1. Retrieve all events for a given threat ID to analyze the attack timeline.
2. Fetch a limited number of events sorted by creation date to quickly review recent activity related to a threat.

Properties

Output

JSON

• id - Unique identifier of the event
• type - Type of the event
• timestamp - Timestamp when the event occurred
• details - Detailed information about the event, including process and threat context
• process
  • name - Name of the process involved in the event
  • id - Identifier of the process involved in the event
• threat
  • id - Identifier of the associated threat
  • severity - Severity level of the threat

Dependencies

• An API key credential for SentinelOne API authentication

Troubleshooting

• Ensure the Threat Id is correctly provided and exists in the SentinelOne system.
• Check API credentials and permissions to access threat event data.
• Verify network connectivity to the SentinelOne API endpoint.
• If pagination is enabled, ensure correct handling of cursor or offset parameters to retrieve all data.
• Review API rate limits and adjust batching or request intervals accordingly.

Links

• SentinelOne API - Get Threat Events - Official API documentation for retrieving threat events by threat ID.