Overview

This node interacts with the SentinelOne Management Console API to update the incident details of a threat. It is useful for security operations teams who need to programmatically update threat incident information in SentinelOne, such as changing the status or adding notes to a threat incident. This can be part of automated workflows for threat management and incident response.

Use Case Examples

1. Automatically update the incident details of a threat when a new alert is received.
2. Integrate with a ticketing system to update threat incidents based on ticket status changes.

Properties

Output

JSON

• json - Response data from the API call, including updated threat incident details and optionally debug information if enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are correctly configured and have permissions to update threat incidents.
• Check that the threat ID provided is valid and exists in the SentinelOne system.
• If using custom headers or query filters, verify they are correctly formatted.
• Enable debug mode to see the full request and response details for troubleshooting.

Links

• SentinelOne API - Update Threat Incident - Official API documentation for updating threat incident details in SentinelOne.