Overview

This node interacts with the SentinelOne API to retrieve information about the appearances of a specific threat across infected endpoints. It is useful for security analysts and IT professionals who want to track where a particular threat has been detected within their network. For example, it can be used to identify all endpoints affected by a malware threat to prioritize remediation efforts.

Use Case Examples

1. Retrieve all infected endpoints and the count of appearances for a given threat ID to assess the spread of the threat within the organization.
2. Use the node to fetch detailed threat appearance data to support incident response and forensic analysis.

Properties

Output

JSON

• infectedEndpoints - List of infected endpoints where the threat appeared
• appearanceCount - Count of appearances of the threat

Dependencies

• An API key credential for SentinelOne API authentication

Troubleshooting

• Ensure the Threat Id is correctly specified and exists in the SentinelOne system.
• Check API credentials and permissions to confirm the node can access threat appearance data.
• If pagination is enabled, verify that pagination parameters are correctly configured to avoid incomplete data retrieval.
• Enable debug mode to inspect the actual API request and response for troubleshooting.

Links

• SentinelOne API - Get Threat Appearances - Official API documentation for retrieving threat appearances in SentinelOne.