SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Process Event

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve detailed information about a specific process creation event related to a threat. It is useful for security analysts and IT professionals who need to investigate and analyze individual process events within a threat context. For example, it can be used to fetch details of a suspicious process event by providing the threat ID and event ID, aiding in threat hunting and incident response.

Use Case Examples

  1. Retrieve detailed information about a specific process event by providing the threat ID and event ID to analyze the behavior of a potential threat.
  2. Investigate a process creation event within a threat to understand its origin and impact on the endpoint.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the process event is being retrieved. This is a required field to specify the threat context.
Event Id The unique identifier of the specific process event to retrieve. This is required to pinpoint the exact event within the threat's timeline.
Add Counts Optional parameter to include count data related to the event. This can provide additional context or metrics about the event.

Output

JSON

  • eventId - The ID of the process event retrieved.
  • processName - Name of the process involved in the event.
  • eventType - Type of the event, e.g., process creation.
  • timestamp - Timestamp when the event occurred.
  • details - Additional details about the process event.

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the Threat Id and Event Id are correctly provided and exist in the SentinelOne system.
  • Check API credentials and permissions to access threat and event data.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If the API returns pagination errors, adjust the 'Return All' and pagination settings accordingly.

Links

Discussion