SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Mitigate Threats

AI-generated

Overview

This node interacts with the SentinelOne API to apply mitigation actions to a group of threats that match specified filters. It is useful in cybersecurity workflows where automated threat response is needed, such as killing, quarantining, or remediating detected threats across multiple endpoints. For example, a security analyst can use this node to automatically quarantine all threats detected in a specific network segment or to rollback remediation on Windows endpoints.

Use Case Examples

  1. Automatically quarantine all threats detected in a specific account or site.
  2. Kill all active threats with a specific file hash across multiple endpoints.
  3. Remediate threats on macOS and Windows endpoints based on policy settings.

Properties

Name Meaning
Action The mitigation action to apply to the threats, e.g., kill, quarantine, remediate, rollback-remediation, un-quarantine, network-quarantine.
Options Additional options for the request such as custom body, headers, query filters, batching, debug mode, pagination, and timeout settings.

Output

JSON

  • json
    • debug - Debug information including URL, query parameters, headers, and body sent with the API request (if debug is enabled).

Dependencies

  • An API key credential for SentinelOne API authentication.

Troubleshooting

  • Ensure the API credentials are correctly configured and have permissions to mitigate threats.
  • Check that the action parameter is valid and supported by the SentinelOne API.
  • If using batching, ensure batch size and interval are set appropriately to avoid rate limiting.
  • Enable debug mode to see detailed request and response information for troubleshooting.

Links

Discussion