SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Threat Available Actions

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve a list of all available actions on threats that match specified filters. It is useful for security analysts and administrators who want to understand what mitigation or management actions can be performed on detected threats within their environment. For example, it can be used to fetch actionable options for threats filtered by criteria such as Kubernetes node name, file path, analyst verdicts, confidence levels, and more.

Use Case Examples

  1. Fetch all available actions for threats detected on specific Kubernetes nodes.
  2. Retrieve available mitigation actions for threats with a certain confidence level or analyst verdict.
  3. Get actionable threat responses filtered by creation or update timestamps.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields Collection of optional filters to narrow down the threats for which available actions are retrieved. Includes filters like Kubernetes node name, file path, analyst verdicts, confidence levels, agent IDs, creation and update timestamps, incident statuses, classifications, and many more.

Output

JSON

  • availableActions - List of available actions on threats matching the filters
  • debug - Debug information including actual URL, query parameters, headers, and body sent for each API request (if debug option is enabled)

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the API credentials are valid and have sufficient permissions to access threat data.
  • Check that the filters provided are correctly formatted and supported by the API.
  • If pagination is enabled, verify that pagination parameters are correctly set to avoid incomplete data.
  • Enable debug option to get detailed request and response information for troubleshooting.

Links

Discussion