AI agents for SentinelOne

List endpoints

Lists endpoints with the SentinelOne agent, optionally by computer name (contains), operating system, network status, whether they have active threats, or free text query.

List threats

Lists threats newest first, optionally only unresolved ones, since a time, by incident status, mitigation status, agent, or free text query (a file name, hash or computer).

Read the activity log

Reads the activity log newest first: threat detections and mitigations, agent changes, user sign-ins and console changes, optionally since a time or for some agents.

Mitigate threatsDeletes data

Runs a mitigation on threats by threat ID: kill (stop the processes), quarantine (move the file into the agent's quarantine), remediate (undo the changes it made), rollback-remediation.

Set a threat's status

Sets the incident status of threats by threat ID: unresolved, in_progress or resolved (resolving does not mitigate; run Mitigate threats first).

Set a threat's verdict

Records the analyst verdict on threats by threat ID: true_positive, false_positive, suspicious or undefined.

Disconnect endpoints from the networkDeletes data

Network-quarantines endpoints by agent ID: they can reach only the SentinelOne console until reconnected, so a compromised machine cannot spread.

Reconnect endpoints to the network

Gives network-quarantined endpoints (by agent ID) their normal network access back.