SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Threats → Threat Analysis

AI-generated

Overview

This node interacts with the SentinelOne API to perform threat analysis for a specified threat ID. It fetches detailed information about a detected threat, including optional components such as threat info. This is useful for security analysts and IT professionals who need to investigate and understand the nature of threats detected in their environment. For example, it can be used to retrieve comprehensive threat details to aid in incident response and remediation planning.

Use Case Examples

  1. Retrieve detailed analysis of a specific threat by providing its threat ID to understand its characteristics and impact.
  2. Fetch additional components related to the threat, such as threat info, to get a complete picture of the threat.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Threat Id The unique identifier of the threat to analyze. This is a required field.
Additional Fields.Components List of components info to fetch. Example: 'threatInfo'.

Output

JSON

  • threat_id - The ID of the threat analyzed
  • analysis - Detailed analysis data of the threat
  • components - Optional components information fetched for the threat
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request (if debug is enabled)

Dependencies

  • An API key credential for SentinelOne API authentication

Troubleshooting

  • Ensure the provided Threat Id is valid and exists in the SentinelOne system.
  • Check API credentials and permissions to access threat analysis data.
  • Enable debug mode to get detailed request and response information for troubleshooting.
  • Handle API rate limits by using batching and request interval settings if processing multiple items.

Links

Discussion