Overview

This node performs multiple actions on threats using the SentinelOne Management Console API. It is useful for security operations where batch processing of threat actions is required, such as mitigating multiple threats at once or applying bulk updates. For example, a security analyst can use this node to disconnect multiple infected agents from the network or to apply remediation actions to a set of threats simultaneously.

Use Case Examples

1. Batch mitigate multiple threats by applying quarantine or kill actions.
2. Bulk update threat notes or analyst verdicts for a list of threat IDs.

Properties

Output

JSON

• json
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for each API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are correctly configured and have the necessary permissions to perform multiple actions on threats.
• Check the batch size and interval settings to avoid hitting API rate limits.
• Enable debug mode to inspect the actual API requests and responses for troubleshooting.
• Verify that the input data items contain valid threat identifiers and required parameters for the selected actions.

Links

• SentinelOne API Documentation - Multiple Actions for Threats - Official API documentation for performing multiple actions on threats in SentinelOne.