SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Timeline Limits

AI-generated

Overview

This node operation fetches the timestamp of the first and last events of a threat's attack storyline from the SentinelOne Management Console API. It is useful for security analysts and incident responders who want to understand the time boundaries of a specific threat's activity within their environment. For example, it can be used to determine the duration of an attack or to correlate threat events with other security logs.

Use Case Examples

  1. Retrieve the timeline limits for a specific threat to analyze the attack duration.
  2. Use the timeline limits to filter and fetch detailed threat events within the specified time range.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the timeline limits are requested.
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Options Additional optional parameters such as custom request body, headers, query filters, batching settings, debug mode, pagination settings, and timeout configuration.

Output

JSON

  • firstEventTimestamp - Timestamp of the first event in the threat's attack storyline.
  • lastEventTimestamp - Timestamp of the last event in the threat's attack storyline.

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the Threat Id is correctly specified and exists in the SentinelOne environment.
  • Check API credentials and permissions to access threat data.
  • Verify network connectivity to the SentinelOne API endpoint.
  • If pagination is enabled, ensure pagination parameters are correctly configured.

Links

Discussion