Overview

This node operation marks an event from Deep Visibility data as a threat in the SentinelOne Management Console. It is used to identify and flag suspicious or malicious activities detected by Deep Visibility, which extends ActiveEDR capabilities by providing full visibility into endpoint data and threat hunting. When an event is marked as a threat, it is added to the blacklist, enabling the SentinelOne Agent to block it immediately if detected on an endpoint. This operation is beneficial for security teams aiming to proactively manage and mitigate threats based on detailed endpoint activity data.

Use Case Examples

1. Mark a suspicious process detected by Deep Visibility as a threat to prevent its execution on endpoints.
2. Use this operation to escalate alerts from Deep Visibility into actionable threats within the SentinelOne platform.

Properties

Output

JSON

• json
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are correctly configured and have permissions to mark threats in Deep Visibility.
• Check that the Deep Visibility feature is enabled and the user role has permissions to mark threats (Admin, IR Team, SOC).
• Verify that the input data contains valid event identifiers from Deep Visibility.
• If rate limiting occurs, adjust batching and batch interval options to reduce request frequency.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne Deep Visibility Documentation - Official documentation for Deep Visibility feature in SentinelOne, explaining its capabilities and usage.