SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Threat Timeline

AI-generated

Overview

This node retrieves the timeline of a specific threat from the SentinelOne Management Console API. It is useful for security analysts and incident responders who want to investigate the sequence of events related to a particular threat. For example, it can be used to fetch detailed activity logs and events associated with a threat to understand its impact and progression.

Use Case Examples

  1. Fetch the timeline of a threat by providing its Threat Id to analyze the attack sequence and related activities.
  2. Use filters such as Site Ids, Activity Types, and Group Ids to narrow down the timeline events for a specific threat.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the timeline is requested.
Return All Whether to return all timeline results or only a single page. When disabled, only one page of results is returned without pagination parameters.
Additional Fields Optional filters and parameters to refine the timeline results, such as Site Ids, Sort By, Activity Types, Group Ids, Limit, Skip Count, Skip, Sort Order, Query, Account Ids, Count Only, and Cursor.
Options Additional request options including custom body, custom headers, query filters, batching settings, debug mode, pagination settings, and timeout.

Output

JSON

  • timeline - Array of timeline events related to the specified threat.

Dependencies

  • an API key credential for SentinelOne Management Console

Troubleshooting

  • Ensure the Threat Id is valid and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat timeline data.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If pagination is enabled, ensure correct handling of pagination parameters to retrieve all data.

Links

Discussion