Overview

This node updates the external ticket ID of a threat in the SentinelOne system. It is useful for integrating SentinelOne threat data with external ticketing or incident management systems, allowing users to link SentinelOne threats to external tickets for better tracking and resolution. For example, a security analyst can update the external ticket ID of a detected threat to reference a Jira or ServiceNow ticket.

Use Case Examples

1. Update the external ticket ID of a specific threat to link it with an external incident management system.
2. Synchronize SentinelOne threat records with external ticketing systems by updating the external ticket ID field.

Properties

Output

JSON

• json
  • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne API authentication.

Troubleshooting

• Ensure the threat ID provided is valid and exists in the SentinelOne system.
• Verify that the API credentials have the necessary permissions to update threat data.
• Check network connectivity and API endpoint availability.
• If debug mode is enabled, review the debug output for request details and error messages to diagnose issues.

Links

• SentinelOne API Documentation - Update Threat External Ticket ID - Official API documentation for updating the external ticket ID of a threat in SentinelOne.