SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Prefetch events

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to prefetch threat events for a specified threat ID. Prefetching events is used to signal the system to start fetching threat events in advance, which speeds up the response time of subsequent API calls related to threat event exploration. This is particularly useful in scenarios where quick access to detailed threat event data is needed, such as in security investigations or automated threat analysis workflows.

Use Case Examples

  1. Prefetch events for a specific threat to improve the performance of threat event retrieval in a security automation workflow.
  2. Use prefetch events to prepare the system for detailed threat event analysis, reducing latency in subsequent API calls.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Threat Id The unique identifier of the threat for which to prefetch events. This is a required field.
Options Additional optional settings such as custom request body, headers, query filters, batching, debug mode, pagination settings, and timeout configuration.

Output

JSON

  • json - The JSON response from the SentinelOne API containing the prefetched threat events or related data.

Dependencies

  • An API key credential for SentinelOne Management Console API

Troubleshooting

  • Ensure the Threat Id is correctly specified and exists in the SentinelOne system.
  • Check API credentials and permissions to confirm access to the threat data.
  • If pagination is enabled, verify pagination parameters are correctly set to avoid incomplete data retrieval.
  • Enable debug mode to inspect the actual API request and response for troubleshooting.

Links

Discussion