SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Threats

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve threat data based on specified filters and options. It supports fetching all matching threats or a single page of results, with extensive filtering capabilities such as Kubernetes node names, file paths, analyst verdicts, confidence levels, agent IDs, creation and update timestamps, incident statuses, and many more. This node is beneficial for security analysts and IT administrators who need to monitor, analyze, and respond to security threats detected by SentinelOne across their endpoints. For example, it can be used to fetch all unresolved threats with high confidence levels or to get threats initiated by specific users or agents.

Use Case Examples

  1. Fetch all threats with a confidence level of 'malicious' and sort by creation date.
  2. Retrieve a single page of threats filtered by specific agent IDs and incident statuses.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields Collection of optional filters to refine the threat search, including Kubernetes node name, file path, analyst verdicts, confidence levels, agent IDs, creation and update timestamps, incident statuses, and many more.

Output

JSON

  • id - Threat unique identifier
  • name - Threat name or title
  • severity - Threat severity level
  • status - Current status of the threat
  • createdAt - Timestamp when the threat was created
  • updatedAt - Timestamp when the threat was last updated
  • agentId - Identifier of the agent where the threat was detected
  • filePath - File path related to the threat
  • analystVerdict - Verdict given by the analyst
  • confidenceLevel - Confidence level of the threat detection
  • incidentStatus - Incident status of the threat
  • initiatedBy - Source that initiated the threat
  • mitigationStatus - Status of mitigation actions for the threat
  • rebootRequired - Indicates if a reboot is required for mitigation
  • externalTicketId - External ticket identifier associated with the threat
  • notes - Notes associated with the threat

Dependencies

  • an API key credential

Troubleshooting

  • Ensure the API key credential is correctly configured and has the necessary permissions to access threat data.
  • Verify that the filter parameters are correctly formatted and valid according to the SentinelOne API documentation.
  • If pagination is enabled, ensure that the pagination settings are correctly configured to avoid incomplete data retrieval.
  • Check for network connectivity issues that might prevent the node from reaching the SentinelOne API endpoint.
  • Review the API rate limits and ensure the node respects them to avoid being throttled or blocked.

Links

Discussion