SentinelOne v2

Use the SentinelOne v2 integration to your organize your company's end points.
This integration was integrated and tested with version xx of SentinelOne Beta

Configure SentinelOne Beta on Demisto

1. Navigate to Settings > Integrations > Servers & Services .
2. Search for SentinelOne Beta.
3. Click Add instance to create and configure a new integration instance.
   • Name : a textual name for the integration instance.
   • Server URL (e.g., https://usea1.sentinelone.net )
   • Username
   • API Token
   • Trust any certificate (not secure)
   • Use system proxy
   • Fetch incidents
   • Fetch limit
   • Incident type
   • First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
   • Minimum risk score for importing incidents (0-10), where 0 is low risk and 10 is high risk
4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. Get all agents: sentinelone-list-agents
2. Create an exclusion: sentinelone-create-white-list-item
3. Get all exclusion items: sentinelone-get-white-list
4. Get the reputation of a hash: sentinelone-get-hash
5. Get a threat list: sentinelone-get-threats
6. Get a threat summary: sentinelone-threat-summary
7. Mark suspicious threats: sentinelone-mark-as-threat
8. Mitigate threats: sentinelone-mitigate-threat
9. Resolve threats: sentinelone-resolve-threat
10. Get agent details: sentinelone-get-agent
11. Get a list of sites: sentinelone-get-sites
12. Get a site list: sentinelone-get-site
13. Reactivate a site: sentinelone-reactivate-site
14. Get a list of activities: sentinelone-get-activities
15. Get group data: sentinelone-get-groups
16. Move agent: sentinelone-move-agent
17. Delete a group: sentinelone-delete-group
18. Retrieve agent processes: sentinelone-agent-processes
19. Connect an agent: sentinelone-connect-agent
20. Disconnect an agent: sentinelone-disconnect-agent
21. Broadcast a message to agents: sentinelone-broadcast-message
22. Get Deep Visibility events: sentinelone-get-events
23. Create a Deep Visibility query: sentinelone-create-query
24. Get a list of Deep Visibility events by process: sentinelone-get-processes
25. Shutdown an agent: sentinelone-shutdown-agent
26. Uninstall an agent: sentinelone-uninstall-agent

1. Get all agents

---

Gets a list of all agents.

Base Command

sentinelone-list-agents

Input

Argument Name	Description	Required
computer_name	Filter by computer name.	Optional
scan_status	CSV list of scan statuses by which to filter the results, for example: “started,abort