Skip to content

Sentinel One

Sentinel One

This module interacts with the Sentinel One API

Configuration

Name Type Description
hostname string The domain-name to the Sentinel One instance
api_token string The API token to authenticate the requests

Actions

Deisolate an endpoint

Connect the endpoint back to the network

Arguments

Name Type Description
ids array The list of Agent IDs to filter by
account_ids array The list of Account IDs to filter by
group_ids array The list of network group to filter by
site_ids array The list of Site IDs to filter by
query string Free-text search term to use

Outputs

Name Type Description
affected integer The number of deisolated endpoints

Get malwares from threat

Fetch the malwares associated to a threat

Arguments

Name Type Description
threat_id string The identifier of threat
timeout integer The maximum time, in seconds, the malwares should be retrieved (default: 300s)
filters object Filters to select the agents from which the malware will be transferred

Outputs

Name Type Description
status string The status of the run
status_reason string The reason of the status
files object The list of retrieved files

Isolate an endpoint

Disconnect the endpoint from the network

Arguments

Name Type Description
ids array The list of Agent IDs to filter by
account_ids array The list of Account IDs to filter by
group_ids array The list of network group to filter by
site_ids array The list of Site IDs to filter by
query string Free-text search term to use

Outputs

Name Type Description
affected integer The number of isolated endpoints

Query events in Deep Visibility

Create a query in Deep Visibility and get the events

Arguments

Name Type Description
group_ids array The list of network group to filter by
site_ids array The list of Site IDs to filter by
query string Free-text search term to use
from_date string Get events created after this timestamp
to_date string Get events created before or at this timestamp
timeout integer The maximum time, in seconds, the query should be processed in (default 300s)

Outputs

Name Type Description
status string The status of the query
status_reason string The reason of the status
events array The events got from the query

Execute a remote script

Execute a remote script and get the results

Arguments

Name Type Description
script_id string The identifier of the script to identify
output_destination string The destination of the result
task_description string A short description of the task
timeout integer The maximum time, in seconds, the execution should be processed in (default: 300s)
settings object The settings to forward the remote script
filters object Filters to select the agents that will run the remote script

Outputs

Name Type Description
status string The status of the run
status_reason string The reason of the status
result_file object The url to download the result (for cloud destination)

Extra

Module Sentinel One v1.2.3