Overview

This node updates the analyst verdict of a threat in the SentinelOne Management Console. It is useful for security analysts who want to change the classification or status of a detected threat based on their investigation. For example, marking a threat as a false positive or confirming it as a true positive.

Use Case Examples

1. Change the analyst verdict of a specific threat to 'true_positive' after manual review.
2. Update the verdict of multiple threats in batch to reflect the latest analysis results.

Properties

Output

JSON

• json - Response from the SentinelOne API after updating the threat analyst verdict

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are valid and have permissions to update threat verdicts.
• Check that the threat ID provided exists and is accessible with the current user scope.
• If rate limiting occurs, use batching and set appropriate batch intervals.
• Enable debug mode to see the full request and response for troubleshooting.

Links

• SentinelOne API Documentation - Update Threat Analyst Verdict - Official API documentation for updating the analyst verdict of a threat.