SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Get Tree

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve a tree view of threat events for a specified threat ID. It is useful for security analysts and IT administrators who want to visualize the hierarchical structure of events related to a particular threat, aiding in threat investigation and response.

Use Case Examples

  1. Retrieve the event tree for a specific threat to understand the sequence and relationship of events during a security incident.
  2. Use the tree view to analyze parent and child events of a threat, helping to identify the root cause and impact.

Properties

Name Meaning
Threat Id The unique identifier of the threat for which the event tree is requested.
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Children Depth Depth of children events to include in the tree.
Selected Event Id ID of the selected event to focus on in the tree.
Limit Limit number of returned items (1-100000).
Skip Number of items to skip from the start.
With Parents Flag to show parents of the selected event.
With Parents Children Flag to show children of the selected event's parents.
Fetch All Children Flag to fetch all children events.

Output

JSON

  • json - The tree view data of threat events.

Dependencies

  • an API key credential for SentinelOne

Troubleshooting

  • Ensure the Threat Id is valid and accessible with the provided credentials.
  • Check API rate limits and adjust batching or request intervals if necessary.
  • Enable debug option to see detailed request and response for troubleshooting.

Links

Discussion