SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Threat Notes

AI-generated

Overview

This node operation retrieves notes associated with a specific threat from the SentinelOne Management Console API. It is useful for security analysts or administrators who want to view detailed notes or comments related to a particular threat for investigation or documentation purposes. For example, a user can fetch all notes for a threat to understand its history or actions taken.

Use Case Examples

  1. Retrieve all notes for a threat with ID '12345' to review investigation comments.
  2. Fetch the latest notes for a threat to assess recent updates or analyst remarks.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Threat Id The unique identifier of the threat for which notes are to be retrieved.
Additional Fields Optional filters and parameters to refine the notes retrieval, such as sorting, limiting the number of notes, skipping counts, and filtering by creator name or ID.

Output

JSON

  • id - Unique identifier of the threat note
  • creator - Name or identifier of the note creator
  • createdAt - Timestamp when the note was created
  • text - Content of the threat note
  • updatedAt - Timestamp when the note was last updated

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the Threat Id is correctly specified and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat notes.
  • If pagination is enabled, verify that pagination parameters are correctly set to avoid incomplete data.
  • Review error messages for rate limiting or network issues and retry accordingly.

Links

Discussion