SentinelOne

Adds a SHA-1 file hash to the SentinelOne blocklist.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Build the request payload
[] Generate the authorization header
[] Request the hash be blocklisted
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Add Hash to Blocklist

prod-nam

prod-eu

prod-apjc

Enables network connectivity for one or more SentinelOne agents. You can either provide a single agent ID or a JSON-formatted list of agent IDs.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Check if the input is a single ID or multiple
[] Generate the authorization header
[] Request network connectivity be enabled
[] Check if the API request succeeded:
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Connect Agent to Network

Disables network connectivity for one or more SentinelOne agents. You can either provide a single agent ID or a JSON-formatted list of agent IDs.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Check if the input is a single ID or multiple
[] Generate the authorization header
[] Request network connectivity be disabled
[] Check if the API request succeeded:
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Disconnect Agent from Network

Fetches one or more agents from SentinelOne by their agent ID or UUID.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Check which type of ID is being searched and build the query string
[] Generate the authorization header
[] Request matching agents from SentinelOne
[] Check if the API request succeeded:
[]> If it did, set the output variables
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Get Agents by ID

Gets a list of CVEs for installed applications from SentinelOne.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Generate the authorization header
[] Request a list of CVEs
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Get Application CVEs

Get a list of all the items on the blocklist from SentinelOne.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Generate the authorization header
[] Build the query string
[] Fetch the blocklist items
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Get Blocklist Items

Fetches a list of sites from SentinelOne using site name, site ID, or a custom query string. See the SentinelOne API documentation for more information about supported query string options.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Build the query string
[] Generate the authorization header
[] Request matching sites from SentinelOne
[] Check if the API request succeeded:
[]> If it did, set the output variables
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Get Sites

Initiates a scan on one or more SentinelOne agents.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Check if the input is a single ID or multiple
[] Generate the authorization header
[] Request the scan be initiated
[] Check if the API request succeeded:
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Initiate Scan

Removes one or more items from the SentinelOne blocklist.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Build the request payload
[] Generate the authorization header
[] Request the item(s) be removed from the blocklist
[] Check if the API request was successful:
[]> If it wasn't, output an error

More information about this API can be found in the SentinelOne documentation

SentinelOne - Remove Items from Blocklist

Searches SentinelOne for agents using device name, MAC address, local IP address, or a custom query string. If no search parameters are provided, all agents will be returned. See the SentinelOne API documentation for more information about supported query string options.

Target: SentinelOne integration target or an HTTP Endpoint for "your-tenant.sentinelone.net" with a path of "/web/api/v2.1"

Account Key: None if using an integration-provided target, API token if using an HTTP endpoint target

Steps:
[] Build the query string
[] Generate the authorization header
[] Request matching agents from SentinelOne
[] Check if the API request succeeded:
[]> If it did, extract the agent information and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the SentinelOne documentation