SentinelOneV2

Integration version: 34.0

Important: This integration refers to SentinelOne and uses API version 2.0.

Note: This integration uses one or more open source components. You can download a copy of the full source code of this integration from the storage bucket.

Configure SentinelOneV2 to work with Google Security Operations SOAR

New Authorization

For the new authorization, an API token is used instead of previously required Username and Password.

Benefits:

• If the account has 2FA, the username-password method stops working but the token works.
• A session token is created for a week, the API token is valid for 6 months, so you need to update credentials twice a year.

Generate an API Token from the WebUI

1. In your Management Console, go to Settings > USERS.
2. Click your username and click Edit.
3. In Edit User > API Token, click Generate.

If the Revoke and Regenerate are present, you already have a token. If you revoke or regenerate it, scripts that use that token won't work. There is no confirmation. Revoke removes the token authorization, while Regenerate revokes the token and generates a new token. If you click Generate or Regenerate, a message shows the token string and the date that the token expires.

Configure SentinelOneV2 integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Instance Name	String	N/A	No	Name of the Instance you intend to configure integration for.
Description	String	N/A	No	Description of the Instance.
API root	String	N/A	Yes	SentinelOne API root.
API Token	String	N/A	Yes	SentinelOne API token. Note: SentinelOne API token needs to be updated every 6 months. This is a SentinelOne policy.
Verify SSL	Checkbox	Checked	Yes	If enabled, verifies that the SSL certificate for the connection to the Sentinel public cloud server is valid.

Note: You can make changes at a later stage if needed. Once configured, the Instances can be used in Playbooks. For detailed information on configuring and supporting multiple instances, see Supporting multiple instances.

Actions

Create Hash Exclusion Record

Add hash to the exclusion list in SentinelOne.

Note: Only the SHA-1 hashes are supported.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Operation System	String	Windows	Yes	Specify the OS for the hash. Possible values: windows, windows_legacy, macos, linux.
Site IDs	String	N/A	No Note: One of them is mandatory.	Specify a comma-separated list of site IDs, where hash needs to be sent to the exclusion list.
Group IDs	String	N/A	No Note: One of them is mandatory.	Specify a comma-separated list of group IDs, where hash needs to be sent to the exclusion list.
Account IDs	CSV	N/A	No	Specify a comma-separated list of account IDs, where hash needs to be sent to the exclusion list.
Description	String	N/A	No	Specify additional information related to the hash.
Add to global exclusion list	Checkbox	Checked	No	If enabled, the action adds a hash to the global exclusion list. Note: When this parameter is enabled, the "Site IDs", "Group IDs" and "Account IDs" parameters are ignored.

Use cases

Analyst can create an exclusion item for an allowlist.

Run On

This action runs on the Hash entity.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
    {
    `ENTITY_IDENTIFIER`:
        {ID: `WHITELISTED_ENTITY_ID`,
        Created Time: `TIME_THE_WHITELISTED_ITEM_WAS_CREATED`,
        Scope ID: `SITE_OR_GROUP_ID`,
        Scope Name: `SCOPE_NAME`}
    }
]

Case Wall

Result type	Value/Description	Type (Entity \ General)
Output message*	If successful for one hash (is_success=true): "Successfully added the following hashes to the exclusion list in SentinelOne:\n{0}".format(entity.identifier) If already exist for at least one hash (is_success=true): "The following hashes were already a part of exclusion list in SentinelOne:\n{0}".format(entity.identifier) If not successful for one hash (is_success=true): "Action wasn't able to add the following hashes to the exclusion list in SentinelOne:\n{0}".format(entity.identifier) If not successful for all hashes (is_success=false): "No hashes were added to the exclusion list in SentinelOne." If a critical error is reported: "Error executing action "Create Hash Exclusion Record". Reason: {0}".(traceback) If the "Site IDs", "Group IDs", "Account IDs" parameters are not provided and the "Add to global exclusion list" parameter is not enabled: "Error executing action "Create Hash Exclusion Record". Reason: at least one value should be provided for "Site IDs" or "Group IDs" or "Account IDs" parameters or "Add to global exclusion list" should be enabled."	General

Create Path Exclusion Record

Add path to the exclusion list in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Path	String	N/A	Yes	Specify the path that needs to be added to the exclusion list.
Operation System	String	Windows	Yes	Specify the OS for the path. Possible values: windows, windows_legacy, macos, linux.
Site IDs	String	N/A	No Note: One of them is mandatory.	Specify a comma-separated list of site IDs, where path needs to be sent to the exclusion list.
Group IDs	String	N/A	No Note: One of them is Mandatory.	Specify a comma-separated list of group IDs, where path needs to be sent to the exclusion list.
Account IDs	CSV	N/A	No	Specify a comma-separated list of account IDs, where path needs to be sent to the exclusion list.
Description	String	N/A	No	Specify additional information related to the path.
Add to global exclusion list	Checkbox	Unchecked	No	If enabled, the action adds the path to the global exclusion list. Note: If this parameter is enabled, the "Site IDs", "Group IDs" and "Account IDs" parameters are ignored.
Include Subfolders	Checkbox	Unchecked	No	If enabled, the action includes subfolders for the provided path. This feature only works, if the user provides a folder path and not the file path.
Mode	DDL	Suppress Alerts Possible values: Suppress Alerts Interoperability Interoperability - Extended Performance Focus Performance Focus - Extended	No	Specify the mode that should be used for the excluded path.

Use cases

Analyst can create an exclusion item for an allowlist.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
    {
    `ENTITY_IDENTIFIER`:
        {ID: `WHITELISTED_ENTITY_ID`,
        Created Time: `TIME_THE_WHITELISTED_ITEM_WAS_CREATED`,
        Scope ID: `SITE_OR_GROUP_ID`,
        Scope Name: `SCOPE_NAME`}
    }
]

Case Wall

Result type	Value/Description	Type (Entity \ General)
Output message*	If successful or errors/title="Already Exists" (is_success=true): "Successfully added path {0} to the exclusion list in SentinelOne:\n{0}".format(path value) If the 400 status code is reported: "Action wasn't able to add path {0} to the exclusion list." Reason: {1}".format(path, errors/detail) If critical error: "Error executing action "Create Path Exclusion Record". Reason: {0}".(traceback) If the "Site IDs", "Group IDs", "Account IDs" parameters are not provided and the "Add to global exclusion list" parameter is not enabled: "Error executing action "Create Path Exclusion Record". Reason: at least one value should be provided for "Site IDs" or "Group IDs" or "Account IDs" parameters or "Add to global exclusion list" should be enabled."	General

Mitigate Threat

Executes mitigation actions on the threats in SentinelOne.

Note: Your role must have permissions to Mitigate Threats - Admin, IR Team, SOC. Rollback is applied only on Windows. Remediate is applied only on macOS and Windows.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Mitigation action	DDL	quarantine Possible Values: quarantine kill un-quarantine remediate rollback-remediate	Yes	Specify the mitigation actions for the provided threats.
Threat IDs	List	N/A	Yes	Specify a comma-separated list of threat IDs that should be mitigated.

Use cases

Analyst can apply a mitigation action to a group of threats.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
        {
            "mitigated": true,
            "mitigation_action": "quarantine",
            "Threat_ID": "838490132706375118"
        }
]

Case Wall

Result type	Value/Description	Type (Entity \ General)
Output message*	If successful for one threat (is_success=true): "Successfully mitigated the following threats in SentinelOne: {0}".format(threat_ids) If no successful for one threat (is_success=true): "Action wasn't able to mitigate the following threats in SentinelOne: {0}".format(threat_ids) If no successful for all threats (is_success=false): "No threats were mitigated."	General

Resolve Threat

Resolve threats in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Threat IDs	List	N/A	Yes	Specify a comma-separated list of threat IDs that need to be resolved.
Annotation	String	N/A	No	Specify an annotation describing, why the threat can be resolved.

Use cases

Analyst can resolve threats.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[{"resolved": false,  "Threat_ID": "509259775582960700" } ]

Case Wall

Result type	Value/Description	Type (Entity \ General)
Output message*	If successful for one threat (is_success=true): "Successfully resolved the following threats in SentinelOne: {0}".format(threat_ids) If no successful for one threat (is_success=true): "Action wasn't able to resolve the following threats in SentinelOne: {0}".format(threat_ids) If no successful for any threat (is_success=false): "No threats were resolved."	General

Mark as Threat

Marks suspicious threats as a true positive threat in SentinelOne.

Note: Your role must have permissions to Mark as Threat - Admin, IR Team, SOC. The item becomes marked as a threat. The option Mark as Threat is available only for Suspicious detections.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Threat IDs	List	N/A	Yes	Specify a comma-separated list of threat IDs that should be marked.

Use cases

Analysts want to mark suspicious threats as a threat.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[{ID: `THREAT_ID`, marked_as_threat: `BOOLEAN`}] **

Note: The boolean indicates if the suspicious threat was successfully marked as a threat.

Case Wall

Result Type	Value / Description	Type
Output message*	If successful for one threat (is_success=true): "Successfully marked the following threats in SentinelOne: {0}".format(threat_ids) If no successful for one threat (is_success=true): "Action wasn't able to mark the following threats in SentinelOne: {0}".format(threat_ids) If no successful for any threat (is_success=false): "No threats were marked."	General

Get Threats

Retrieve information about threats in SentinelOne.

Note: Your role must have permissions to Mark as Threat - Admin, IR Team, SOC. The item becomes marked as a threat. The option Mark as Threat is available only for Suspicious detections.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Mitigation Status	String	N/A	No	Specify a comma-separated list of threat statuses. Only threats that match the statuses are returned. Possible values: mitigated, active, blocked, suspicious, suspicious_resolved
Created until	String	N/A	No	Specify the end time for the threats. Example: 2020-03-02T21:30:13.014874Z
Created from	String	N/A	No	Specify the start time for the threats. Example: 2020-03-02T21:30:13.014874Z
Resolved Threats	Checkbox	Unchecked	No	If enabled, the action only returns resolved threats.
Threat Display Name	String	N/A	No	Specify a display name of the threat that you want to return. Partial name also works.
Limit	Integer	10	No	Specify the number of threats to return.
API Version	DDL	2.0 Possible values: 2.0 2.1		Specify the version of API to use in the action. If nothing is provided the connector uses the 2.1 version. Note: The JSON result structure is different between API versions. It is recommended to use the latest one.

Use cases

Analysts want to know threat ID.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

{
            "accountId": "433241117337583618",
            "accountName": "SentinelOne",
            "agentComputerName": "desktop-43QNK0O",
            "agentDomain": "WORKGROUP",
            "agentId": "823949401337686055",
            "agentInfected": false,
            "agentIp": "76.112.223.210",
            "agentIsActive": false,
            "agentIsDecommissioned": false,
            "agentMachineType": "desktop",
            "agentNetworkStatus": "connected",
            "agentOsType": "windows",
            "agentVersion": "3.6.6.104",
            "annotation": null,
            "automaticallyResolved": false,
            "browserType": null,
            "certId": "",
            "classification": "generic.heuristic",
            "classificationSource": "Cloud",
            "classifierName": "MANUAL",
            "cloudVerdict": "provider_unknown",
            "collectionId": "838490132723152335",
            "commandId": "835975626369402963",
            "createdAt": "2020-03-02T21:30:13.014874Z",
            "createdDate": "2020-03-02T21:30:12.748000Z",
            "description": "malware detected - not mitigated yet",
            "engines": [
                "manual"
            ],
            "external_ticket_id": null,
            "fileContentHash": "fc5a9b5e806f35a7b285e012ef8df3f06f399492",
            "fileCreatedDate": null,
            "fileDisplayName": "GameBar.exe",
            "fileExtensionType": "Executable",
            "fileIsDotNet": null,
            "fileIsExecutable": true,
            "fileIsSystem": false,
            "fileMaliciousContent": null,
            "fileObjectId": "99FF941D82E382D1",
            "filePath": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.XboxGamingOverlay_3.36.6003.0_x64__8wekyb3d8bbwe97f11a01-b980-4b88-806c-276c42d4d3d4\\GameBar.exe",
            "fileSha256": null,
            "fileVerificationType": "NotSigned",
            "fromCloud": false,
            "fromScan": false,
            "id": "838490132706375118",
            "indicators": [],
            "initiatedBy": "dvCommand",
            "initiatedByDescription": "Deep Visibility Command",
            "initiatingUserId": "823741543702652055",
            "isCertValid": false,
            "isInteractiveSession": false,
            "isPartialStory": false,
            "maliciousGroupId": "0BB46E119EF0AE51",
            "maliciousProcessArguments": "-ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mca",
            "markedAsBenign": true,
            "mitigationMode": "protect",
            "mitigationReport": {
                "kill": {
                    "status": "success"
                },
                "network_quarantine": {
                    "status": null
                },
                "quarantine": {
                    "status": "success"
                },
                "remediate": {
                    "status": null
                },
                "rollback": {
                    "status": null
                },
                "unquarantine": {
                    "status": "sent"
                }
            },
            "mitigationStatus": "mitigated",
            "publisher": "",
            "rank": 2,
            "resolved": true,
            "siteId": "823740645903492137",
            "siteName": "Siemplify.co",
            "threatAgentVersion": "3.6.6.104",
            "threatName": "GameBar.exe",
            "updatedAt": "2020-07-07T17:19:48.260119Z",
            "username": "DESKTOP-43QNK0O\\ddiserens",
            "whiteningOptions": []
}

Case Wall

Result Type	Value / Description	Type
Output message*	If data is available (is_success=true): "Successfully retrieved information about the available threats in SentinelOne." If no data is available (is_success=false): "No information about threats was found based on the provided criteria."	General

Disconnect Agent From Network

Disconnect an agent from a network by its hostname or IP address.

Parameters

N/A

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Enrich Endpoints

Enrich information about the endpoint by IP Address or Hostname.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Create Insight	Checkbox	Checked	No	If enabled, the action creates an insight with information about endpoints.
Only Infected Endpoints Insights	Checkbox	Checked	No	If enabled, the action only creates insights for the infected endpoints.

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_succeed:False

JSON Result

{
    "accountId": "433241117337583618",
    "accountName": "SentinelOne",
    "activeDirectory": {
        "computerDistinguishedName": "CN=LP-YAIR,CN=Computers,DC=SIEMPLIFY,DC=LOCAL",
        "computerMemberOf": [],
        "lastUserDistinguishedName": "CN=Yair Stern,OU=Users,OU=PS,OU=IL,OU=Operations,OU=Siemplify,DC=SIEMPLIFY,DC=LOCAL",
        "lastUserMemberOf": [
            "CN=esx.cs,OU=ESX,OU=GROUPS,OU=IL,OU=IT,OU=Siemplify,DC=SIEMPLIFY,DC=LOCAL",
            "CN=Backup Operators,CN=Builtin,DC=SIEMPLIFY,DC=LOCAL",
            "CN=esx.product,OU=ESX,OU=GROUPS,OU=IL,OU=IT,OU=Siemplify,DC=SIEMPLIFY,DC=LOCAL",
            "CN=Siemplify_Admins,OU=QA,OU=IL,OU=IT,OU=Siemplify,DC=SIEMPLIFY,DC=LOCAL",
            "CN=Local Admin,OU=GROUPS,OU=IL,OU=IT,OU=Siemplify,DC=SIEMPLIFY,DC=LOCAL",
            "CN=CSM,OU=Operations,OU=Siemplify,DC=SIEMPLIFY,DC=LOCAL",
            "CN=Event Log Readers,CN=Builtin,DC=SIEMPLIFY,DC=LOCAL"
        ]
    },
    "activeThreats": 0,
    "agentVersion": "4.1.4.82",
    "allowRemoteShell": false,
    "appsVulnerabilityStatus": "patch_required",
    "computerName": "LP-Yair",
    "consoleMigrationStatus": "N/A",
    "coreCount": 8,
    "cpuCount": 8,
    "cpuId": "Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz",
    "createdAt": "2020-05-31T07:22:14.695136Z",
    "domain": "SIEMPLIFY",
    "encryptedApplications": false,
    "externalId": "",
    "externalIp": "84.109.241.91",
    "groupId": "863712577864500060",
    "groupIp": "84.109.241.x",
    "groupName": "Test Group",
    "id": "903293150232960453",
    "inRemoteShellSession": false,
    "infected": false,
    "installerType": ".msi",
    "isActive": false,
    "isDecommissioned": false,
    "isPendingUninstall": false,
    "isUninstalled": false,
    "isUpToDate": true,
    "lastActiveDate": "2021-01-12T12:59:43.143066Z",
    "lastIpToMgmt": "192.168.1.20",
    "lastLoggedInUserName": "yair",
    "licenseKey": "",
    "locationType": "fallback",
    "locations": [
        {
            "id": "629380164464502476",
            "name": "Fallback",
            "scope": "global"
        }
    ],
    "machineType": "laptop",
    "mitigationMode": "protect",
    "mitigationModeSuspicious": "protect",
    "modelName": "Dell Inc. - Latitude 7490",
    "networkInterfaces": [
        {
            "id": "931547468641304837",
            "inet": [
                "192.168.1.20"
            ],
            "inet6": [
                "2a10:8002:22a6:0:e4fd:4e37:4db6:f01c",
                "2a10:8002:22a6:0:d5a6:6a91:1281:acc6",
                "fe80::e4fd:4e37:4db6:f01c"
            ],
            "name": "Wi-Fi",
            "physical": "d0:c6:37:d6:f1:2d"
        },
        {
            "id": "1062894239338355970",
            "inet": [
                "192.168.193.193"
            ],
            "inet6": [
                "fe80::fcc6:8ba0:da2b:c22d"
            ],
            "name": "vEthernet (Default Switch)",
            "physical": "00:15:5d:45:7c:74"
        },
        {
            "id": "954982488643857092",
            "inet": [
                "10.0.75.1"
            ],
            "inet6": [
                "fe80::1ce0:8d0c:69ae:8616",
                "fe80::1ce0:8d0c:69ae:8616"
            ],
            "name": "vEthernet (DockerNAT)",
            "physical": "00:15:5d:0a:14:21"
        }
    ],
    "networkStatus": "connecting",
    "osArch": "64 bit",
    "osName": "Windows 10 Pro",
    "osRevision": "18363",
    "osStartTime": "2021-01-03T15:38:32Z",
    "osType": "windows",
    "osUsername": null,
    "rangerStatus": "NotApplicable",
    "rangerVersion": null,
    "registeredAt": "2020-05-31T07:22:14.691561Z",
    "scanAbortedAt": null,
    "scanFinishedAt": "2020-05-31T09:28:53.867014Z",
    "scanStartedAt": "2020-05-31T07:25:37.814972Z",
    "scanStatus": "finished",
    "siteId": "823740645903492137",
    "siteName": "Siemplify.co",
    "threatRebootRequired": false,
    "totalMemory": 16263,
    "updatedAt": "2021-01-18T13:33:43.834618Z",
    "userActionsNeeded": [],
    "uuid": "87511ad6ea63462594268bfdc4c546db"
}

Case Wall

Result Type	Value / Description	Type
Output message*	If successful (is_success=true): "Successfully retrieved information about the following endpoins from SentinelOne: \n{0}" .format(entity.identifier) If not successful for some endpoints (is_success=true): "Action wasn't able to retrieve information about the following endpoins from SentinelOne: \n{0}" .format(entity.identifier) If not successful for all endpoints (is_success=false): "No information was retrieved for the provided entities."	General

Get Agent Status

Retrieve information about the status of the agents on the endpoints based on the IP Address or Hostname entity.

Parameters

N/A

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

{
"status": "Not active"
}

Case Wall

Result Type	Value / Description	Type
Output message*	If successful (is_success=true): "Successfully retrieved information about agent status for the following endpoints: \n{0}".format(entity.identifier)" If not successful for some endpoints (is_success=true): "Action wasn't able to retrieve information about agent status for the following endpoints: \n{0}".format(entity.identifier)" If not successful for all endpoint (is_success=false): "No information about agent status was found for the provided endpoints."	General

Get Application List for Endpoint

Retrieve information about available applications on the endpoint by IP Address or Hostname.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Max Applications To Return	Integer	N/A	No	Specify the number of applications to return. If nothing is specified, the action returns all of the applications.

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

{
    "data": [
        {
            "installedDate": "2021-01-06T08:55:56.762000Z",
            "name": "Mozilla Firefox 84.0.1 (x64 en-US)",
            "publisher": "Mozilla",
            "size": 211562,
            "version": "84.0.1"
        }
    ]
}

Case Wall

Result Type	Value / Description	Type
Output message*	If successful (is_success=true): "Successfully retrieved available applications for the following endpoints: \n{0}".format(entity.identifier)" If not successful for one endpoint (is_success=true): "Action wasn't able to retrieve available applications for the following endpoints: \n{0}".format(entity.identifier)" If not successful for all endpoints (is_success=false): "No applications were retrieved for the provided endpoints."	General

Get Events for Endpoint Hours Back

Retrieve information about the latest events on the endpoint. Works with the IP Address and Hostname entities.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Hours Back	String	N/A	Yes	Specify the number hours backwards to fetch events.
Events Amount Limit	String	50	No	Specify the number of events to return per event type.
Include File Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the file events.
Include Indicator Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the indicator events.
Include DNS Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the DNS events.
Include Network Actions Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the "network actions" events.
Include URL Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the URL events.
Include Registry Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the registry events.
Include Scheduled Task Events Information	Checkbox	Unchecked	No	If enabled, the action also queries information about the scheduled task events.

Use cases

Analysts may use this action to get information about the latest events related to one endpoint, which can help in the triage process.

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

{
    "data": [
        {
            "activeContentFileId": null,
            "activeContentHash": null,
            "activeContentPath": null,
            "activeContentSignedStatus": null,
            "activeContentType": null,
            "agentDomain": "",
            "agentGroupId": "823740645928657962",
            "agentId": "849867819647755581",
            "agentInfected": false,
            "agentIp": "3.136.184.160",
            "agentIsActive": true,
            "agentIsDecommissioned": false,
            "agentMachineType": "server",
            "agentName": "ip-10-0-2-205",
            "agentNetworkStatus": "connected",
            "agentOs": "linux",
            "agentTimestamp": "2020-03-19T08:17:01.575Z",
            "agentUuid": "11dd65a0-9b2d-e631-73da-4cc15d6bbc9e",
            "agentVersion": "3.3.1.14",
            "attributes": [
                {
                    "display": "Created At",
                    "display_attribute": false,
                    "field_id": "agentTimestamp",
                    "priority": 3,
                    "queryable": false,
                    "section": "Main Attributes",
                    "value": "2020-03-19T08:17:01.575Z"
                },{
                    "display": "Site ID",
                    "display_attribute": false,
                    "field_id": "siteId",
                    "priority": 7,
                    "queryable": true,
                    "section": "Endpoint Info",
                    "value": null
                }
            ],
            "containerId": null,
            "containerImage": null,
            "containerLabels": null,
            "containerName": null,
            "createdAt": "2020-03-19T08:17:01.575000Z",
            "eventType": "Process Creation",
            "hasParent": true,
            "id": "401693219383738379",
            "k8sClusterName": null,
            "k8sControllerLabels": null,
            "k8sControllerName": null,
            "k8sControllerType": null,
            "k8sNamespace": null,
            "k8sNamespaceLabels": null,
            "k8sNode": null,
            "k8sPodLabels": null,
            "k8sPodName": null,
            "md5": null,
            "objectType": "process",
            "parentPid": "32461",
            "parentProcessName": "dash",
            "parentProcessStartTime": "2020-03-19T08:17:01.785Z",
            "parentProcessUniqueKey": "12f6fc9d-d213-474a-eae7-62240ec731c9",
            "pid": "32462",
            "processCmd": " run-parts --report /etc/cron.hourly",
            "processDisplayName": null,
            "processGroupId": "c98a4557-94b5-da31-5074-fe6360f17228",
            "processImagePath": "/bin/run-parts",
            "processImageSha1Hash": "66df74a1f7cc3509c87d6a190ff90ac86caf440d",
            "processIntegrityLevel": "INTEGRITY_LEVEL_UNKNOWN",
            "processIsRedirectedCommandProcessor": "False",
            "processIsWow64": "False",
            "processName": "run-parts",
            "processRoot": "False",
            "processSessionId": "0",
            "processStartTime": "2020-03-19T08:17:01.787Z",
            "processSubSystem": "SUBSYSTEM_UNKNOWN",
            "processUniqueKey": "c460aa89-aaf8-8366-e1ef-2554d291acb6",
            "publisher": null,
            "relatedToThreat": "False",
            "sha256": null,
            "signatureSignedInvalidReason": null,
            "signedStatus": "unsigned",
            "siteName": "Siemplify.co",
            "trueContext": "c98a4557-94b5-da31-5074-fe6360f17228",
            "user": "unknown",
            "verifiedStatus": null
        }
    ],
    "pagination": {
        "nextCursor": "eyJpZF9jb2x1bW4iOiAiaWQiLCAiaWRfdmFsdWUiOiAiNDAxNjkzMjE5MzgzNzM4Mzc5IiwgInNvcnRfYnlfY29sdW1uIjogImFnZW50VGltZXN0YW1wIiwgInNvcnRfYnlfdmFsdWUiOiAiMjAyMC0wMy0xOVQwODoxNzowMS41NzVaIiwgInNvcnRfb3JkZXIiOiAiZGVzYyJ9",
        "totalItems": 632
    }
}

Case Wall

Result Type	Value / Description	Type
Output message*	If found at least one event: "Successfully retrieved information about the events for the following endpoints: \n{0}".format(entity.identifier)" If not found event for one endpoint: "Action wasn't able to find any events for the following endpoints:\n {0}".format(entity.identifier)" If not found event for all endpoints: "No information events for the provided endpoints."	General

Get Group Details

Retrieve detailed information about the provided groups.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Group Names	String	N/A	Yes	Specify a comma-separated list of group names for which you want to retrieve details.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[{`GROUP_NAME`:response.get('data')}]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should neither fail nor stop a playbook execution: If successful for one group: "Successfully retrieved information about the following groups in SentinelOne: \n {group name}" If not successful for one group: "Action wasn't able to retrieve information about the following groups in SentinelOne:\n {group name}" If not successful for all groups: "No information about the provided groups was found" The action should fail and stop a playbook execution: If a fatal error, SDK error, like wrong credentials, no connection, other is reported: "Error executing action "Get Group Details". Reason: {0}''.format(error.Stacktrace)	General
CSV	Table Name: SentinelOne Groups Table Columns: ID Name Type Rank Creator Creation Time	General

Get Hash Reputation

Retrieve information about the hashes from SentinelOne.

Parameters

entities

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Reputation Threshold	Integer	5	No	Specify the reputation threshold in order to be marked as suspicious. If nothing is provided, the action does not mark entities as suspicious. Maximum: 10
Create Insight	Checkbox	Checked	No	If enabled, the action creates an insight containing information about the reputation.
Only Suspicious Hashes Insight	Checkbox	Checked	No	If enabled, the action only creates insight for hashes that have higher or equal reputation to the "Reputation Threshold" value.

Run On

This action runs on the Hash entity.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Enrichment Table

Enrichment Field Name	Logic - When to apply
SENO_reputation = rank	Returns if it exists in JSON result.

Get Process List for Endpoint

Deprecated: This action is deprecated. Use the "Get Application List For Endpoint" action instead.

Get System Status

Retrieve the status of a system.

Parameters

N/A

Use cases

Analysts may use this action to check that SentinelOne is working properly.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

{
    "system_status": {
        "data": {
            "health": "ok"
        }},
    "db_status": {
        "data": {
            "health": "ok"
        }},
    "cache_status": {
        "data": {
            "health": "ok"
        }
    }
}

Get System Version

Retrieve the version of a system.

Parameters

N/A

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Initiate Full Scan

Initiate a full disk scan on the endpoint in SentinelOne.

Parameters

N/A

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result Type	Value / Description	Type
Output message*	If successful for at least one endpoint (is_success=true): "Successfully started the full disk scan on the following endpoints in SentinelOne: {0}".format(entity.identifier) If not successful for at least one endpoint (is_success=true): "Action wasn't able to start a full disk scan on the following endpoints in SentinelOne: {0}".format(entity.identifier) If not successful for all endpoints (is_success=false): "No full disk scans were initiated."	General

Move Agents

Move agents to the provided group. This action works with the Hostname and IP Address entities.

Note: The group should be from the same site.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Group ID	String	N/A	No	Specify the ID of the group, where to move the agents.
Group Name	String	N/A	No	Specify the name of the group, where to move the agents. Note: If both the "Group ID" parameter and the "Group Name" parameter are provided, the action puts the "Group ID" parameter in the priority.

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result Type	Value / Description	Type
Output message*	If successful for at least one endpoint: "Successfully moved the following endpoints to the group with {0} {1} in SentinelOne:\n{2}".format("ID"/"Name", group_id/group_name,entity.identity) If no successful for at least one endpoint: "Action wasn't able to move the following endpoints to the group with {0} {1} in SentinelOne:\n{2}".format("ID"/"Name", group_id/group_name,entity.identity) If no successful for all endpoint: "No endpoints were moved to the group {0} {1} in SentinelOne".format("ID"/"Name", group_id/group_name) If the group is not found: "Action wasn't able to move endpoints to the group with {0} {1} in SentinelOne. Reason: Group was not found.".format("ID"/"Name", group_id/group_name) If the "Group Name" or "Group ID" parameter is not provided (fail): "Error executing action "Move Agents". Reason: either "Group Name" or "Group ID" should be provided."	General

Ping

Test integration connectivity.

Parameters

N/A

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Reconnect Agent to the Network

Reconnect disconnected endpoint to the network. Works with the Hostname and IP Address entities.

Run On

This action runs on the following entities:

• IP Address
• Hostname

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Create Hash Black List Record

Add hashes to a blocklist in SentinelOne.

Note: Only the SHA-1 hashes are supported.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Operating System	String	windows	Yes	Specify the OS for the hash. Possible values: windows, windows_legacy, macos, linux.
Site IDs	Array	N/A	No	Specify a comma-separated list of site IDs, where hash needs to be sent to the blocklist.
Group IDs	Array	N/A	No	Specify a comma-separated list of group IDs, where hash needs to be sent to the blocklist.
Account IDs	Array	N/A	No	Specify a comma-separated list of account IDs, where hash needs to be sent to the blocklist.
Description	String	""	No	Specify additional information related to the hash.
Add to global blocklist	Checkbox	Unchecked	Yes	If enabled, the action adds the hash to the global blocklist. Note: If this parameter is enabled, the "Site IDs", "Group IDs", and "Account IDs" parameters are ignored.

Run On

This action runs on the Hash entity.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
    {
        "Entity": "36F9CA40B3CE96FCEE1CF1D4A7222935536FD25A",
        "EntityResult": [{
            "userName": "user",
            "description": "Created by Siemplify.",
            "userId": "8237415437026xxxxx",
            "scopeName": "Test Group",
            "value": "36F9CA40B3CE96FCEE1CF1D4A7222935536FD25A",
            "source": "user",
            "updatedAt": "2020-07-02T14:41:20.678280Z",
            "osType": "windows",
            "scope": {
                "groupIds": ["863712577864500060"]
            },
            "type": "white_hash",
            "id": "926706979756730756",
            "createdAt": "2020-07-02T14:41:20.678690Z"
        }, {
            "userName": "user",
            "description": "Created by Siemplify.",
            "userId": "8237415437026xxxxx",
            "scopeName": "Test Group 2",
            "value": "36F9CA40B3CE96FCEE1CF1D4A7222935536FD25A",
            "source": "user",
            "updatedAt": "2020-07-02T14:41:20.683858Z",
            "osType": "windows",
            "scope": {
                "groupIds": ["926559911218143489"]
            },
            "type": "white_hash",
            "id": "926706979807062407",
            "createdAt": "2020-07-02T14:41:20.684677Z"
        }]
    }
]

Case Wall

Result Type	Value / Description	Type
Output message*	If successful for one hash (is_success=true): "Successfully added the following hashes to the blacklist in SentinelOne:\n{0}".format(entity.identifier) If already exist for at least one (is_success=true): "The following hashes were already a part of blacklist in SentinelOne:\n{0}".format(entity.identifier) If not successful for one hash (is_success=true): "Action wasn't able to add the following hashes to the blacklist in SentinelOne:\n{0}".format(entity.identifier) If not successful for all hashes (is_success=false): "No hashes were added to the blacklist in SentinelOne." If a critical error is reported: "Error executing action "Create Hash Blacklist Record". Reason: {0}".(traceback) If the "Site IDs", "Group IDs", "Account IDs" are not provided and the "Add to global black list" parameter is not enabled: "Error executing action "Create Hash Blacklist Record". Reason: at least one value should be provided for "Site IDs" or "Group IDs" or "Account IDs" parameters or "Add to global black list" should be enabled.	General

Get Blacklist

Get a list of all the items available in the blocklist in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Hash	String	N/A	No	Specify a comma-separated list of hashes that need to be checked in the blocklist. Only hashes that were found are returned. If nothing is specified here the action returns all hashes. Note: If the "Hash" parameter is provided then the "Limit" parameter is ignored.
Site IDs	Array	N/A	No	Specify a comma-separated list of site IDs, which should be used to return blocklist items.
Group IDs	Array	N/A	No	Specify a comma-separated list of group IDs, which should be used to return blocklist items.
Account Ids	Array	N/A	No	Specify a comma-separated list of account IDs, which should be used to return blocklist items.
Limit	Integer	50	No	Specify the number of blocklist items that should be returned. Note: If the "Hash" parameter has values, then this parameter is ignored. Maximum: 1000
Query	String	N/A	No	Specify the query that needs to be used in order to filter the results.
Use Global Blacklist	Checkbox	Unchecked	No	If enabled, the action also returns hashes from the global blacklist.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
    {
        "userName": "Example",
        "description": "test",
        "userId": "8237415437026xxxxx",
        "scopeName": "Siemplify.co",
        "value": "cf23df2207d99a74fbe169e3eba035e633bxxxxx",
        "source": "user",
        "updatedAt": "2020-02-27T15:02:54.686991Z",
        "osType": "windows",
        "scope": {
            "siteIds": ["8237406459034xxxxx"]
        },
        "type": "black_hash",
        "id": "8353960925573xxxxx",
        "createdAt": "2020-02-27T15:02:54.687675Z"
    }, {
        "description": "Detected by SentinelOne Cloud",
        "userId": null,
        "scopeName": "Siemplify.co",
        "value": "3395856ce81f2b7382dee72602f798b642fxxxxx",
        "source": "cloud",
        "updatedAt": "2020-03-18T14:42:02.730095Z",
        "osType": "linux",
        "scope": {
            "siteIds": ["8237406459034xxxxx"]
        },
        "type": "black_hash",
        "id": "8498811050050xxxxx",
        "createdAt": "2020-03-18T14:42:02.730449Z"
    }, {
        "description": "Detected by SentinelOne Cloud",
        "userId": null,
        "scopeName": "Siemplify.co",
        "value": "df531d66173235167ac502b867f3cae2170xxxxx",
        "source": "cloud",
        "updatedAt": "2020-04-08T07:27:35.686775Z",
        "osType": "linux",
        "scope": {
            "siteIds": ["8237406459034xxxxx"]
        },
        "type": "black_hash",
        "id": "8648827291549xxxxx",
        "createdAt": "2020-04-08T07:27:35.687168Z"
    }
]

Case Wall

Result Type	Value / Description	Type
Output message*	If successful and has results (is_success=true): "Successfully retrieved blacklisted hashes based on the provided filter criteria in SentinelOne.". If successful and no results are found (is_success=false): "No blacklisted hashes were found for the provided criteria in SentinelOne." If a critical error is reported: "Error executing action "Get Blacklist". Reason: {0}".(traceback) If the "Site IDs", "Group IDs", "Account IDs" parameters are not provided and the "Use Global Blacklist" parameter is not enabled: "Error executing action "Get Blacklist". Reason: at least one value should be provided for "Site IDs" or "Group IDs" or "Account IDs" parameters or "Use Global Blacklist" should be enabled.	General
Table	Table Name: Blacklist Hashes Table Columns: Hash Scope Description OS User	General

Get Deep Visibility Query Result

Retrieve information about deep visibility query results.

Note: This action should be used in combination with the "Initiate Deep Visibility Query" action.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Query ID	String	N/A	Yes	Specify the ID of the query for which you want to return results. This ID is available in the JSON result of the "Initiate Deep Visibility Query" action as the "query_id" parameter.
Limit	String	50	No	Specify the number of events to return. Maximum: 100

Run On

This action doesn't run on any entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

##### Case Wall

Result Type	Value / Description	Type
Output message*	The action should neither fail nor stop a playbook execution: If successful: "Successfully found events for query: <query id>." The action should fail and stop a playbook execution: If a fatal error, SDK error, like wrong credentials, no connection, other is reported: "Error executing action "Get Deep Visibility Query Result". Reason: {0}''.format(error.Stacktrace If the 400 status code is reported (fail): "Error executing action "Get Deep Visibility Query Result". Reason: {0}".format(errors/detail) If the query status is not set to "Finished" (fail): "Error executing action "Get Deep Visibility Query Result". Reason: status of the query - {0}. Please run action 'Initialize Deep Visibility Query' again.".format(query status)	General
CSV Table	Table Title: SentinelOne Events Table Columns: Event Type Site Name Time Agent OS Process ID Process UID Process Name MD5 SHA256	General

Initiate Deep Visibility Query

Initiate a Deep Visibility Query search. Returns the Query ID, which should be used in the "Get Deep Visibility Query Result" action.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Query	String	N/A	Yes	Specify the query for the search.
Start Date	String	N/A	No	Specify the start date for the search. If nothing is specified, the action fetches events from 30 days ago.
End Date	String	N/A	No	Specify the end date for the search. If nothing is specified, the action uses current time.

Run On

This action doesn't run on any entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[{"query_id\":\"q0794f2c18433b38115982b501017c636"}]",

Case Wall

Result Type	Value / Description	Type
Output message*	The action should neither fail nor stop a playbook execution: If successful: "Successfully created a deep visibility query. Query ID: <query ID value>" If failed to run (no data): "Failed to create a deep visibility query" The action should fail and stop a playbook execution: If a fatal error, SDK error, like wrong credentials, no connection, other is reported: "Error executing action "Initiate a Deep Visibility Query". Reason: {0}''.format(error.Stacktrace) If the 400 status code is reported (fail): "Error executing action 'Initiate Deep Visibility Query'. Reason: {0}".format(errors/detail)	General

Download Threat File

Download a file related to the threat in SentinelOne.

Note: Your user role must have permissions to Fetch Threat File - Admin, IR Team, SOC.

Known Limitation

Sometimes SentinelOne initiates a file fetch, but doesn't provide a download URL. In that case, action runs into a timeout. To confirm this situation, you need to navigate to the timeline of the threat.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Threat ID	String	N/A	Yes	Specify the ID of the threat for which you want to download the file.
Password	Password	N/A	Yes	Specify the password for the zip that contains the threat file. Password requirements: At least 10 characters Needs to include: uppercase, lowercase, digits, special symbols Maximum length is 256 characters.
Download Folder Path	String	N/A	Yes	Specify the path to the folder, where you want to store the threat file.
Overwrite	Checkbox	Unchecked	Yes	If enabled, the action overwrites the file with the same name.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

{
"absolute_path": "`ABSOLUTE_PATH_TO_THE_FILE`"
}

Case Wall

Result Type	Value / Description	Type
Output message*	The action should neither fail nor stop a playbook execution: If the file is downloaded (is_success = true): "Successfully downloaded the file related to threat {0} in SentinelOne ".format(threat_id) If activityType=86 is not found (is_success=false): "Action wasn't able to download the file related to threat {threat_id}. Reason: action was able to initiate the downloading of the file, but SentinelOne didn't return a download URL." Async message: "Waiting for the download link to appear in SentinelOne" The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, folder doesn't exist, other is reported: "Error executing action "Download Threat File". Reason: {0}''.format(error.Stacktrace) If the 400 status code is reported: "Error executing action "Download Threat File". Reason: {0}".format(errors/detail) If the file with the same name already exists, but "Overwrite" is set to false: "Error executing action "Download Threat File". Reason: file with path {0} already exists. Please delete the file or set "Overwrite" to true."	General

Update Analyst Verdict

Update analyst verdict of the threat in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Threat ID	String	N/A	Yes	Specify a comma-separated list of threat IDs for which you want to update the analyst verdict.
Analyst Verdict	DDL	Undefined Possible Values: True Positive False Positive Suspicious Undefined	Yes	Specify the analyst verdict.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result Type	Value / Description	Type
Output message*	If successful for some threats (is_success=true): "Successfully updated analyst verdict for the following threats in SentinelOne: {threat id}." If not successful for some threats (is_success=true): "Action wasn't able to update analyst verdict for the following threats in SentinelOne: {threat id}." If not successful for some threats (is_success=false): "Action wasn't able to update analyst verdict for the provided threats in SentinelOne."	General

Update Incident Status

Update threat incident status in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Threat ID	String	N/A	Yes	Specify a comma-separated list of threat ids for which you want to update the incident status.
Status	DDL	Resolved Possible Values: Unresolved In Progress Resolved	Yes	Specify the incident status.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result Type	Value / Description	Type
Output message*	If successful for some incidents (is_success=true): "Successfully updated incident status for the following threats in SentinelOne: {threat id}." If not successful for some incidents (is_success=true): "Action wasn't able to update incident status for the following threats in SentinelOne: {threat id}." If not successful for some incidents (is_success=false): "Action wasn't able to update incident status for the provided threats in SentinelOne."	General

Add Threat Note

Add a note to the threat in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Threat ID	String	N/A	Yes	Specify the ID of the threat for which you want to add a note.
Note	String	N/A	Yes	Specify the note that needs to be added to the threat.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result Type	Value / Description	Type
Output message*	The action should neither fail nor stop a playbook execution: If successful (is_success=true): "Successfully added note to the threat {threat id} in SentinelOne." If not successful (is_success=false): "Action wasn't able to add a note to the threat {threat id} in SentinelOne." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Add Threat Note". Reason: {0}''.format(error.Stacktrace)	General

Delete Hash Blacklist Record

Delete hashes from a blocklist in SentinelOne.

Note: Only the SHA-1 hashes are supported.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Site IDs	String	N/A	No	Specify a comma-separated list of site IDs, from where the hash needs to be removed.
Group IDs	String	N/A	No	Specify a comma-separated list of group IDs, from where the hash needs to be removed.
Account IDs	String	N/A	No	Specify a comma-separated list of account IDs, from where the hash needs to be removed.
Remove from global black list	Checkbox	Unchecked	No	If enabled, the action removes the hash from the global blocklist. Note: If this parameter is enabled, the "Site IDs", "Group IDs" and "Account IDs" parameters are ignored.

Run On

This action runs on the Hash entity.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result type	Value/Description	Type (Entity \ General)
Output message*	The action should neither fail nor stop a playbook execution: If successful for one entity (is_success=true): "Successfully removed the following hashes from blacklist in SentinelOne: {\n entity.identifier}" If not successful for one (not SHA1) (is_success=true): "Action wasn't able to remove the following hashes from blacklist in SentinelOne: {\n entity.identifier}" If the hash is not found (is_success=true): "The following hashes were not found in the blacklist in SentinelOne: {\n entity.identifier}" If not successful for all entities (is_success=false): "No hashes were removed from blacklist in SentinelOne." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Delete Hash Blacklist Record". Reason: {error traceback}" If the "Site IDs", "Group IDs", "Account IDs" parameters are not provided: "Error executing action "Delete Hash Blacklist Record". Reason: at least one value should be provided for "Site IDs" or "Group IDs". If the "Site IDs", "Group IDs", "Account IDs" parameters are not provided and the "Remove from global black list" is not enabled: "Error executing action "Delete Hash Blacklist Record". Reason: at least one value should be provided for "Site IDs" or "Group IDs" or "Account IDs" parameters or "Remove from global black list" should be enabled."	General

List Sites

List available sites in SentinelOne.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Filter Key	DDL	Select One Possible Values: Name ID	No	Specify the key that needs to be used to filter sites.
Filter Logic	DDL	Not Specified Possible Values: Not Specified Equal Contains	No	Specify the filter logic that should be applied. Filtering logic is working based on the value provided in the "Filter Key" parameter.
Filter Value	String	N/A	No	Specify the value that should be used in the filter. If "Equal" is selected, the action tries to find the exact match among results. If "Contains" is selected, the action tries to find results that contain the specified substring. If nothing is provided in this parameter, the filter is not applied. Filtering logic works based on the value provided in the "Filter Key" parameter.
Max Records To Return	Integer	50	No	Specify the number of records to return.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case Wall

Result type	Value/Description	Type (Entity \ General)
Output message*	The action should neither fail nor stop a playbook execution: If data is available (is_success = true): "Successfully found sites for the provided criteria in SentinelOne". If data is not available (is_success=false): "No sites were found for the provided criteria in {product name}" If the "Filter Value" parameter is empty (is_success=true): "The filter was not applied, because parameter "Filter Value" has an empty value." The action should fail and stop a playbook execution: If the "Filter Key" parameter is set to "Select One" and the "Filter Logic" is set to "Equal" or "Contains": "Error executing action "{action name}"." Reason: you need to select a field from the "Filter Key" parameter. If the "Filter Logic" parameter is set to "Equal" or "Contains": "Error executing action "{action name}"." Reason: you need to select a field from the "Filter Key" parameter. If an invalid value is provided for the "Max Records to Return" parameter: "Error executing action "{action name}"." Reason: "Invalid value was provided for "Max Records to Return": . Positive number should be provided". If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)"	General
Case Wall Table	Table Name: Available Sites Table Columns: Name ID Creator Expiration Type State	General

Connectors

SentinelOne - Threats Connector

Pull threats from SentinelOne.

For this connector we are changing the authorization method, adding an ability to filter alerts based on whitelists.

Authorization changes

Username and Password fields are removed and API Token is added.

Whitelist logic

The connector is able to filter alerts based on the Alert Name. A new connector parameter, Use whitelist as a blacklist, is introduced - which will change the logic, based on the value.

Use whitelist as a blacklist = false

With these conditions, allowlist is used as intended. Only alerts that have alert_names in the allowlist will be ingested into Google Security Operations SOAR.

Use whitelist as a blacklist = true.

With these conditions, allowlist is used as a blocklist. Only alerts that don't have alert_names in the allowlist will be ingested into Google Security Operations SOAR.

If there are no Alert Names in the allowlist, all alerts are ingested.

Use cases and examples

Analysts may use this connector to get threats from SentinelOne.

Configure SentinelOne - Threats Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Product Field Name	String	siemplify_event	Yes	Describes the name of the field where the product name is stored.
Event Field Name	String	classificationSource	Yes	Describes the name of the field where the event name is stored.
Environment Field Name	String	""	No	Describes the name of the field where the environment name is stored. If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern	String	.*	No	A regular expression pattern to run on the value found in the "Environment Field Name" field. Default is .* to catch all and return the value unchanged. Used to allow the user to manipulate the environment field using the regular expression logic. If the regular expression pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds)	Integer	180	Yes	Timeout limit for the python process running the current script.
API Root	String	https://usea1-partners.sentinelone.net/	Yes	Address of SentinelOne API root.
API Token	String	N/A	Yes	SentinelOne API token.
API Version	String	2.0		Specify what version of api to use in the connector. If nothing is provided connector will use version 2.1. Note: Google Security Operations SOAR Event structure is different between API versions. It is recommended to use the latest one. Possible values: 2.0, 2.1.
Fetch Max Days Backwards	Integer	1	No	Amount of days from where to fetch threats. Note: If you set the parameter to a specific value, the connector ingests alerts from a period when it was disabled. That is, if the Fetch Max Days Backwards parameter is set to one day, and the connector gets disabled and enabled again after one day, the connector still ingests alerts for the time period when it was disabled.
Use whitelist as a blacklist	Checkbox	Unchecked	Yes	If enabled, allowlist will be used as a blocklist.
Verify SSL	Checkbox	Checked	Yes	If enabled, verify the SSL certificate for the connection to the Sentinel public cloud server is valid.
Proxy Server Address	String	N/A	No	The address of the proxy server to use
Proxy Username	String	N/A	No	The proxy username to authenticate with
Proxy Password	Password	N/A	No	The proxy password to authenticate with
Event Object Type Filter	CSV	N/A	No	A comma-separated list of event objects that need to be returned alongside threat info. This parameter is used as a filter to only return certain objects. Examples: process,ip,indicators. If nothing is provided, the connector ingests all event object types.
Event Type Filter	CSV	N/A	No	A comma-separated list of event types that need to be returned alongside threat info. This parameter is used as a filter to only return certain event types. Examples: Process Creation, Behavioral Indicators
Max Events To Return	Integer	199	No	Specify the number of events to return per threat. Maximum: 199

Connector rules

The connector supports proxy.

The connector supports allowlist and blocklist.