Overview

This node interacts with the SentinelOne Management Console API to retrieve a short summary of threats as seen on the Dashboard. It is useful for security analysts and administrators who want to get an overview of threat data filtered by specific criteria such as Site IDs, Group IDs, or Account IDs. The node supports pagination and can return all results or a single page, making it suitable for both quick checks and detailed data retrieval.

Use Case Examples

1. Get a summary of all threats for specific Site IDs to monitor security status across multiple locations.
2. Retrieve a threat summary filtered by Group IDs to analyze threats affecting particular organizational units.
3. Fetch a complete list of threat summaries for all accounts to generate comprehensive security reports.

Properties

Output

JSON

• summary - The short threat summary data as returned by the SentinelOne API.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are correctly configured and have the necessary permissions to access threat summary data.
• Check network connectivity to the SentinelOne Management Console API endpoint.
• Verify that the input parameters such as Site IDs, Group IDs, and Account IDs are correctly formatted and valid.
• If pagination is enabled, ensure that the pagination settings match the API's expected parameters to avoid incomplete data retrieval.
• Enable debug mode to see the actual API request and response details for troubleshooting.

Links

• SentinelOne API - Get Threat Summary - Official API documentation for retrieving threat summary data from SentinelOne Management Console.