Integrate SentinelOne v2 with Google SecOps

Integration version: 37.0

This document explains how to configure and integrate SentinelOne v2 with Google Security Operations (Google SecOps).

This integration uses SentinelOne API 2.0.

This integration uses one or more open source components. You can download a zipped copy of the full source code of this integration from the Cloud Storage bucket.

Use cases

The SentinelOne integration can help you solve the following use cases:

1. Contain infected endpoints: use Google SecOps capabilities to isolate an infected host and prevent lateral movement and data exfiltration.

2. Retrieve detailed endpoint information: use Google SecOps capabilities to enrich incident data with in-depth host analysis for better context and decision-making. You can automatically query SentinelOne for detailed information about an endpoint involved in an alert, including agent version, operating system, and network interfaces.

3. Initiate Deep Visibility scans: use Google SecOps capabilities to hunt for threats and hidden malware on suspect machines and initiate a full disk scan using SentinelOne when suspicious activity is detected, such as unusual file modifications or registry changes.

4. Investigate threats with threat intelligence: use Google SecOps capabilities to improve accuracy by correlating SentinelOne alerts with threat intelligence data, forward suspicious hashes, file paths, or IP addresses found within SentinelOne alerts to threat intelligence platforms.

5. Triage malware: use Google SecOps capabilities to automatically classify malware with static analysis tools for streamlined incident response. You can extract samples from infected endpoints, trigger the analysis within your environment, and receive classification for the malware based on the static analysis.

Before you begin

To use the SentinelOne v2 integration, you need a SentinelOne API token.

To generate the API token, complete the following steps:

1. In your SentinelOne management console, go to Settings > Users.

2. Click your username.

3. Go to Actions > API Token Operations.

4. Click Generate API Token. Copy the API token and use it to configure the integration. The generated API token is valid for six months.

Integration parameters

The SentinelOne v2 integration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances.

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action.

Add Threat Note

Use the Add Threat Note action to add a note to the threat in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Add Threat Note action requires the following parameters:

Action outputs

The Add Threat Note action provides the following outputs:

Output messages

The Add Threat Note action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add Threat Note action:

Create Hash Black List Record

Use the Create Hash Black List Record action to add hashes to a blocklist in SentinelOne.

This action only supports SHA-1 hashes.

This action runs on the Google SecOps Hash entity.

Action inputs

The Create Hash Black List Record action requires the following parameters:

Action outputs

The Create Hash Black List Record action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Create Hash Black List Record action:

[
    {
        "Entity": "ENTITY_ID",
        "EntityResult": [{
            "userName": "user",
            "description": "Created by user.",
            "userId": "USER_ID",
            "scopeName": "Test Group",
            "value": "36F9CA40B3CE96FCEE1CF1D4A7222935536FD25A",
            "source": "user",
            "updatedAt": "2020-07-02T14:41:20.678280Z",
            "osType": "windows",
            "scope": {
                "groupIds": ["GROUP_ID"]
            },
            "type": "white_hash",
            "id": "ENTITY_ID",
            "createdAt": "2020-07-02T14:41:20.678690Z"
        }, {
            "userName": "user",
            "description": "Created by user.",
            "userId": "USER_ID",
            "scopeName": "Test Group 2",
            "value": "36F9CA40B3CE96FCEE1CF1D4A7222935536FD25A",
            "source": "user",
            "updatedAt": "2020-07-02T14:41:20.683858Z",
            "osType": "windows",
            "scope": {
                "groupIds": ["GROUP_ID"]
            },
            "type": "white_hash",
            "id": "ENTITY_ID",
            "createdAt": "2020-07-02T14:41:20.684677Z"
        }]
    }
]

Output messages

The Create Hash Black List Record action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Create Hash Black List Record action:

Create Hash Exclusion Record

Use the Create Hash Exclusion Record action to add a hash to the exclusion list in SentinelOne.

This action only supports SHA-1 hashes.

This action runs on the Google SecOps Hash entity.

Action inputs

The Create Hash Exclusion Record action requires the following parameters:

Action outputs

The Create Hash Exclusion Record action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Create Hash Exclusion Record action:

[
    {
    "ENTITY_ID":
        {
        "ID": "ALLOWLISTED_ENTITY_ID",
        "Created Time": "ITEM_CREATION_TIME",
        "Scope ID": "SITE_OR_GROUP_ID",
        "Scope Name": "example_scope"
        }
    }
]

Output messages

The Create Hash Exclusion Record action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Create Hash Exclusion Record action:

Create Path Exclusion Record

Use the Create Path Exclusion Record action to add a path to the exclusion list in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Create Path Exclusion Record action requires the following parameters:

The default value is Suppress Alerts.

Action outputs

The Create Path Exclusion Record action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Create Path Exclusion Record action:

[
    {
    "ENTITY_ID":
        {
        "ID": "ALLOWLISTED_ENTITY_ID",
        "Created Time": "ITEM_CREATION_TIME",
        "Scope ID": "SITE_OR_GROUP_ID",
        "Scope Name": "example_scope"
        }
    }
]

Output messages

The Create Path Exclusion Record action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Create Path Exclusion Record action:

Delete Hash Blacklist Record

Use the Delete Hash Blacklist Record action to delete hashes from a blocklist in SentinelOne.

This action only supports the SHA-1 hashes.

This action runs on the Google SecOps Hash entity.

Action inputs

The Delete Hash Blacklist Record action requires the following parameters:

Action outputs

The Delete Hash Blacklist Record action provides the following outputs:

Output messages

The Delete Hash Blacklist Record action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Delete Hash Blacklist Record action:

Disconnect Agent From Network

Use the Disconnect Agent From Network action to disconnect an agent from a network using the agent's hostname or IP address.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

None.

Action outputs

The Disconnect Agent From Network action provides the following outputs:

Script result

The following table lists the value for the script result output when using the Disconnect Agent From Network action:

Download Threat File

Use the Download Threat File action to download a file related to a threat in SentinelOne.

To retrieve threat files in SentinelOne, you need any of the following roles:

• Admin
• IR Team
• SOC

This action doesn't run on Google SecOps entities.

Action limitations

The Download Threat File action can reach timeout when SentinelOne retrieves a file, but doesn't provide a download URL.

To investigate the cause for timeout, go to the threat timeline.

Action inputs

The Download Threat File action requires the following parameters:

Action outputs

The Download Threat File action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Download Threat File action:

{
    "absolute_path": "ABSOLUTE_PATH"
}

Output messages

The Download Threat File action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Download Threat File action:

Enrich Endpoints

Use the Enrich Endpoints action to enrich information about the endpoint using the IP address or hostname.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

The Enrich Endpoints action requires the following parameters:

Action outputs

The Enrich Endpoints action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Enrich Endpoints action:

{
    "accountId": "ACCOUNT_ID",
    "accountName": "SentinelOne",
    "activeDirectory": {
        "computerDistinguishedName": "CN=LP-EXAMPLE,CN=Computers,DC=EXAMPLE,DC=LOCAL",
        "computerMemberOf": [],
        "lastUserDistinguishedName": "CN=Example,OU=Users,OU=PS,OU=IL,OU=Operations,OU=EXAMPLE,DC=EXAMPLE,DC=LOCAL",
        "lastUserMemberOf": [
            "CN=esx.cs,OU=ESX,OU=GROUPS,OU=IL,OU=IT,OU=EXAMPLE,DC=EXAMPLE,DC=LOCAL",
            "CN=Backup Operators,CN=Builtin,DC=EXAMPLE,DC=LOCAL",
            "CN=esx.product,OU=ESX,OU=GROUPS,OU=IL,OU=IT,OU=EXAMPLE,DC=EXAMPLE,DC=LOCAL",
            "CN=EXAMPLE_Admins,OU=QA,OU=IL,OU=IT,OU=EXAMPLE,DC=EXAMPLE,DC=LOCAL",
            "CN=Local Admin,OU=GROUPS,OU=IL,OU=IT,OU=EXAMPLE,DC=EXAMPLE,DC=LOCAL",
            "CN=CSM,OU=Operations,OU=EXAMPLE,DC=EXAMPLE,DC=LOCAL",
            "CN=Event Log Readers,CN=Builtin,DC=EXAMPLE,DC=LOCAL"
        ]
    },
    "activeThreats": 0,
    "agentVersion": "4.1.4.82",
    "allowRemoteShell": false,
    "appsVulnerabilityStatus": "patch_required",
    "computerName": "LP-EXAMPLE",
    "consoleMigrationStatus": "N/A",
    "coreCount": 8,
    "cpuCount": 8,
    "cpuId": "Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz",
    "createdAt": "2020-05-31T07:22:14.695136Z",
    "domain": "EXAMPLE",
    "encryptedApplications": false,
    "externalId": "",
    "externalIp": "192.0.2.91",
    "groupId": "863712577864500060",
    "groupIp": "192.0.2.0",
    "groupName": "Test Group",
    "id": "ID",
    "inRemoteShellSession": false,
    "infected": false,
    "installerType": ".msi",
    "isActive": false,
    "isDecommissioned": false,
    "isPendingUninstall": false,
    "isUninstalled": false,
    "isUpToDate": true,
    "lastActiveDate": "2021-01-12T12:59:43.143066Z",
    "lastIpToMgmt": "192.0.2.20",
    "lastLoggedInUserName": "EXAMPLE",
    "licenseKey": "",
    "locationType": "fallback",
    "locations": [
        {
            "id": "ID",
            "name": "Fallback",
            "scope": "global"
        }
    ],
    "machineType": "laptop",
    "mitigationMode": "protect",
    "mitigationModeSuspicious": "protect",
    "modelName": "Dell Inc. - Latitude 7490",
    "networkInterfaces": [
        {
            "id": "ID",
            "inet": [
                "192.0.2.20"
            ],
            "inet6": [
                "2001:db8:1:1:1:1:1:1",
                "2001:db8:2:2:2:2:2:2",
                "2001:db8:ffff:ffff:ffff:ffff:ffff:ffff"
            ],
            "name": "Wi-Fi",
            "physical": "MAC_ADDRESS"
        },
        {
            "id": "ID",
            "inet": [
                "192.168.193.193"
            ],
            "inet6": [
                "2001:db8:ffff:ffff:ffff:ffff:ffff:ffff"
            ],
            "name": "vEthernet (Default Switch)",
            "physical": "MAC_ADDRESS"
        },
        {
            "id": "ID",
            "inet": [
                "201.0.113.1"
            ],
            "inet6": [
                "2001:db8:1:1:1:1:1:1",
                "2001:db8:2:2:2:2:2:2"
            ],
            "name": "vEthernet (DockerNAT)",
            "physical": "MAC_ADDRESS"
        }
    ],
    "networkStatus": "connecting",
    "osArch": "64 bit",
    "osName": "Windows 10 Pro",
    "osRevision": "18363",
    "osStartTime": "2021-01-03T15:38:32Z",
    "osType": "windows",
    "osUsername": null,
    "rangerStatus": "NotApplicable",
    "rangerVersion": null,
    "registeredAt": "2020-05-31T07:22:14.691561Z",
    "scanAbortedAt": null,
    "scanFinishedAt": "2020-05-31T09:28:53.867014Z",
    "scanStartedAt": "2020-05-31T07:25:37.814972Z",
    "scanStatus": "finished",
    "siteId": "SITE_ID",
    "siteName": "example.com",
    "threatRebootRequired": false,
    "totalMemory": 16263,
    "updatedAt": "2021-01-18T13:33:43.834618Z",
    "userActionsNeeded": [],
    "uuid": "UUID"
}

Output messages

The Enrich Endpoints action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enrich Endpoints action:

Get Agent Status

Use the Get Agent Status action to retrieve information about the status of agents on the endpoints based on the provided entity.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

None.

Action outputs

The Get Agent Status action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Agent Status action:

{
"status": "Not active"
}

Output messages

The Get Agent Status action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Agent Status action:

Get Application List for Endpoint

Use the Get Application List for Endpoint action to retrieve information about available applications on an endpoint using the provided entities.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

The Get Application List for Endpoint action requires the following parameters:

Action outputs

The Get Application List for Endpoint action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Application List for Endpoint action:

{
    "data": [
        {
            "installedDate": "2021-01-06T08:55:56.762000Z",
            "name": "Mozilla Firefox 84.0.1 (x64 en-US)",
            "publisher": "Mozilla",
            "size": 211562,
            "version": "84.0.1"
        }
    ]
}

Output messages

The Get Application List for Endpoint action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Application List for Endpoint action:

Get Blacklist

Use the Get Blacklist action to get a list of all the items available in the blocklist in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Blacklist action requires the following parameters:

Action outputs

The Get Blacklist action provides the following outputs:

Case wall table

The Get Blacklist action can return the following table:

Table name: Blocklist Hashes

Table columns:

• Hash
• Scope
• Description
• OS
• User

JSON result

The following example shows the JSON result output received when using the Get Blacklist action:

[
    {
        "userName": "Example",
        "description": "test",
        "userId": "USER_ID",
        "scopeName": "Example.com",
        "value": "cf23df2207d99a74fbe169e3eba035e633bxxxxx",
        "source": "user",
        "updatedAt": "2020-02-27T15:02:54.686991Z",
        "osType": "windows",
        "scope": {
            "siteIds": ["SITE_ID"]
        },
        "type": "black_hash",
        "id": "8353960925573xxxxx",
        "createdAt": "2020-02-27T15:02:54.687675Z"
    }, {
        "description": "Detected by SentinelOne Cloud",
        "userId": null,
        "scopeName": "Example.com",
        "value": "3395856ce81f2b7382dee72602f798b642fxxxxx",
        "source": "cloud",
        "updatedAt": "2020-03-18T14:42:02.730095Z",
        "osType": "linux",
        "scope": {
            "siteIds": ["SITE_ID"]
        },
        "type": "black_hash",
        "id": "ENTITY_ID",
        "createdAt": "2020-03-18T14:42:02.730449Z"
    }, {
        "description": "Detected by SentinelOne Cloud",
        "userId": null,
        "scopeName": "Example.com",
        "value": "df531d66173235167ac502b867f3cae2170xxxxx",
        "source": "cloud",
        "updatedAt": "2020-04-08T07:27:35.686775Z",
        "osType": "linux",
        "scope": {
            "siteIds": ["SITE_ID"]
        },
        "type": "black_hash",
        "id": "ENTITY_ID",
        "createdAt": "2020-04-08T07:27:35.687168Z"
    }
]

Output messages

The Get Blacklist action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Blacklist action:

Get Deep Visibility Query Result

Use the Get Deep Visibility Query Result action to retrieve information about the Deep Visibility query results.

Run this action in combination with the Initiate Deep Visibility Query action.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Deep Visibility Query Result action requires the following parameters:

Action outputs

The Get Deep Visibility Query Result action provides the following outputs:

Case wall table

The Get Deep Visibility Query Result action can return the following table:

Table name: SentinelOne Events

Table columns:

• Event Type
• Site Name
• Time
• Agent OS
• Process ID
• Process UID
• Process Name
• MD5
• SHA256

Output messages

The Get Deep Visibility Query Result action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Deep Visibility Query Result action:

Get Events for Endpoint Hours Back

Use the Get Events for Endpoint Hours Back action to retrieve information about the latest events on an endpoint.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

The Get Events for Endpoint Hours Back action requires the following parameters:

Action outputs

The Get Events for Endpoint Hours Back action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Events for Endpoint Hours Back action:

{
    "data": [
        {
            "activeContentFileId": null,
            "activeContentHash": null,
            "activeContentPath": null,
            "activeContentSignedStatus": null,
            "activeContentType": null,
            "agentDomain": "",
            "agentGroupId": "GROUP_ID",
            "agentId": "ID",
            "agentInfected": false,
            "agentIp": "192.0.2.160",
            "agentIsActive": true,
            "agentIsDecommissioned": false,
            "agentMachineType": "server",
            "agentName": "ip-203-0-113-205",
            "agentNetworkStatus": "connected",
            "agentOs": "linux",
            "agentTimestamp": "2020-03-19T08:17:01.575Z",
            "agentUuid": "UUID",
            "agentVersion": "3.3.1.14",
            "attributes": [
                {
                    "display": "Created At",
                    "display_attribute": false,
                    "field_id": "agentTimestamp",
                    "priority": 3,
                    "queryable": false,
                    "section": "Main Attributes",
                    "value": "2020-03-19T08:17:01.575Z"
                },{
                    "display": "Site ID",
                    "display_attribute": false,
                    "field_id": "siteId",
                    "priority": 7,
                    "queryable": true,
                    "section": "Endpoint Info",
                    "value": null
                }
            ],
            "containerId": null,
            "containerImage": null,
            "containerLabels": null,
            "containerName": null,
            "createdAt": "2020-03-19T08:17:01.575000Z",
            "eventType": "Process Creation",
            "hasParent": true,
            "id": "ID",
            "k8sCluame": null,
            "k8sControllerLabels": null,
            "k8sControllerName": null,
            "k8sControllerType": null,
            "k8sNamespace": null,
            "k8sNamespaceLabels": null,
            "k8sNode": null,
            "k8sPodLabels": null,
            "k8sPodName": null,
            "md5": null,
            "objectType": "process",
            "parentPid": "32461",
            "parentProcessName": "dash",
            "parentProcessStartTime": "2020-03-19T08:17:01.785Z",
            "parentProcessUniqueKey": "KEY",
            "pid": "32462",
            "processCmd": " run-parts --report /etc/cron.hourly",
            "processDisplayName": null,
            "processGroupId": "GROUP_ID",
            "processImagePath": "/bin/run-parts",
            "processImageSha1Hash": "66df74a1f7cc3509c87d6a190ff90ac86caf440d",
            "processIntegrityLevel": "INTEGRITY_LEVEL_UNKNOWN",
            "processIsRedirectedCommandProcessor": "False",
            "processIsWow64": "False",
            "processName": "run-parts",
            "processRoot": "False",
            "processSessionId": "0",
            "processStartTime": "2020-03-19T08:17:01.787Z",
            "processSubSystem": "SUBSYSTEM_UNKNOWN",
            "processUniqueKey": "KEY",
            "publisher": null,
            "relatedToThreat": "False",
            "sha256": null,
            "signatureSignedInvalidReason": null,
            "signedStatus": "unsigned",
            "siteName": "example.com",
            "trueContext": "c98a4557-94b5-da31-5074-fe6360f17228",
            "user": "unknown",
            "verifiedStatus": null
        }
    ],
    "pagination": {
        "nextCursor": "VALUE",
        "totalItems": 632
    }
}

Output messages

The Get Events for Endpoint Hours Back action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Events for Endpoint Hours Back action:

Get Group Details

Use the Get Group Details action to retrieve detailed information about provided groups.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Group Details action requires the following parameters:

Action outputs

The Get Group Details action provides the following outputs:

Case wall table

The Get Group Details action can return the following table:

Table name: SentinelOne Groups

Table columns:

• ID
• Name
• Type
• Rank
• Creator
• Creation Time

JSON result

The following example shows the JSON result output received when using the Get Group Details action:

[
    {
        "GROUP_NAME":"UNEDITABLE_VARIABLERESPONSE_DATA"
    }
]

Output messages

The Get Group Details action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Group Details action:

Get Hash Reputation

Use the Get Hash Reputation action to retrieve information about hashes from SentinelOne.

This action runs on the Google SecOps Hash entity.

Action inputs

The Get Hash Reputation action requires the following parameters:

Action outputs

The Get Hash Reputation action provides the following outputs:

Enrichment table

The Get Hash Reputation action can enrich the following fields:

Script result

The following table lists the value for the script result output when using the Get Hash Reputation action:

Get Process List for Endpoint - Deprecated

Get System Status

Use the Get System Status action to retrieve the status of a system.

This action runs on all Google SecOps entities.

Action inputs

None.

Action outputs

The Get System Status action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get System Status action:

{
    "system_status": {
        "data": {
            "health": "ok"
        }},
    "db_status": {
        "data": {
            "health": "ok"
        }},
    "cache_status": {
        "data": {
            "health": "ok"
        }
    }
}

Script result

The following table lists the value for the script result output when using the Get System Status action:

Get System Version

Use the Get System Version action to retrieve the version of a system.

This action runs on all Google SecOps entities.

Action inputs

None.

Action outputs

The Get System Version action provides the following outputs:

Script result

The following table lists the value for the script result output when using the Get System Version action:

Get Threats

Use the Get Threats action to retrieve information about threats in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Threats action requires the following parameters:

Action outputs

The Get Threats action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Threats action:

{
            "accountId": "ACCOUNT_ID",
            "accountName": "ACCOUNT_NAME",
            "agentComputerName": "desktop-example",
            "agentDomain": "WORKGROUP",
            "agentId": "AGENT_ID",
            "agentInfected": false,
            "agentIp": "192.0.2.176",
            "agentIsActive": false,
            "agentIsDecommissioned": false,
            "agentMachineType": "desktop",
            "agentNetworkStatus": "connected",
            "agentOsType": "windows",
            "agentVersion": "3.6.6.104",
            "annotation": null,
            "automaticallyResolved": false,
            "browserType": null,
            "certId": "",
            "classification": "generic.heuristic",
            "classificationSource": "Cloud",
            "classifierName": "MANUAL",
            "cloudVerdict": "provider_unknown",
            "collectionId": "838490132723152335",
            "commandId": "835975626369402963",
            "createdAt": "2020-03-02T21:30:13.014874Z",
            "createdDate": "2020-03-02T21:30:12.748000Z",
            "description": "malware detected - not mitigated yet",
            "engines": [
                "manual"
            ],
            "external_ticket_id": null,
            "fileContentHash": "fc5a9b5e806f35a7b285e012ef8df3f06f399492",
            "fileCreatedDate": null,
            "fileDisplayName": "example.exe",
            "fileExtensionType": "Executable",
            "fileIsDotNet": null,
            "fileIsExecutable": true,
            "fileIsSystem": false,
            "fileMaliciousContent": null,
            "fileObjectId": "99FF941D82E382D1",
            "filePath": "\\Device\\HarddiskVolume3\\Program Files\\example.exe",
            "fileSha256": null,
            "fileVerificationType": "NotSigned",
            "fromCloud": false,
            "fromScan": false,
            "id": "THREAT_ID",
            "indicators": [],
            "initiatedBy": "dvCommand",
            "initiatedByDescription": "Deep Visibility Command",
            "initiatingUserId": "INITIATING_USER_ID",
            "isCertValid": false,
            "isInteractiveSession": false,
            "isPartialStory": false,
            "maliciousGroupId": "0BB46E119EF0AE51",
            "maliciousProcessArguments": "-ServerName:App.Example.mca",
            "markedAsBenign": true,
            "mitigationMode": "protect",
            "mitigationReport": {
                "kill": {
                    "status": "success"
                },
                "network_quarantine": {
                    "status": null
                },
                "quarantine": {
                    "status": "success"
                },
                "remediate": {
                    "status": null
                },
                "rollback": {
                    "status": null
                },
                "unquarantine": {
                    "status": "sent"
                }
            },
            "mitigationStatus": "mitigated",
            "publisher": "",
            "rank": 2,
            "resolved": true,
            "siteId": "SITE_ID",
            "siteName": "Example.com",
            "threatAgentVersion": "3.6.6.104",
            "threatName": "example.exe",
            "updatedAt": "2020-07-07T17:19:48.260119Z",
            "username": "DESKTOP-example\\ddiserens",
            "whiteningOptions": []
}

Output messages

The Get Threats action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Threats action:

Initiate Deep Visibility Query

Use the Initiate Deep Visibility Query action to initiate a Deep Visibility query search.

This action returns the query ID value which the Get Deep Visibility Query Result action requires.

This action doesn't run on Google SecOps entities.

Action inputs

The Initiate Deep Visibility Query action requires the following parameters:

Action outputs

The Initiate Deep Visibility Query action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Initiate Deep Visibility Query action:

[
    {
        "query_id": "QUERY_ID"
    }
]

Output messages

The Initiate Deep Visibility Query action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Initiate Deep Visibility Query action:

Initiate Full Scan

Use the Initiate Full Scan action to initiate a full disk scan on an endpoint in SentinelOne.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

None.

Action outputs

The Initiate Full Scan action provides the following outputs:

Output messages

The Initiate Full Scan action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Initiate Full Scan action:

List Sites

Use the List Sites action to list available sites in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The List Sites action requires the following parameters:

Action outputs

The List Sites action provides the following outputs:

Case wall table

The List Sites action can return the following table:

Table name: Available Sites

Table columns:

• Name
• ID
• Creator
• Expiration
• Type
• State

Output messages

The List Sites action can return the following output messages:

Script result

The following table lists the value for the script result output when using the List Sites action:

Mark as Threat

Use the Mark as Threat action to mark suspicious threats as true positive threats in SentinelOne.

To mark threats in SentinelOne, you need any of the following roles:

• Admin
• IR Team
• SOC

You can mark as threats only suspicious detections.

This action doesn't run on Google SecOps entities.

Action inputs

The Mark as Threat action requires the following parameters:

Action outputs

The Mark as Threat action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Mark as Threat action:

[
    {
        "ID": "DETECTION_ID",
        "marked_as_threat": "true"
    }
]

Output messages

The Mark as Threat action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Mark as Threat action:

Mitigate Threat

Use the Mitigate Threat action to execute mitigation actions on the threats in SentinelOne.

To mitigate threats in SentinelOne, you need any of the following roles:

• Admin
• IR Team
• SOC

The rollback applies only to Windows. The threat remediation applies only to macOS and Windows.

This action doesn't run on Google SecOps entities.

Action inputs

The Mitigate Threat action requires the following parameters:

Action outputs

The Mitigate Threat action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Mitigate Threat action:

[
        {
            "mitigated": true,
            "mitigation_action": "quarantine",
            "Threat_ID": "THREAT_ID"
        }
]

Output messages

The Mitigate Threat action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Mitigate Threat action:

Move Agents

Use the Move Agents action to move agents to the provided group from the same site.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

The Move Agents action requires the following parameters:

Action outputs

The Move Agents action provides the following outputs:

Output messages

The Move Agents action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Move Agents action:

Ping

Use the Ping action to test the connectivity.

This action runs on all Google SecOps entities.

Action inputs

None.

Action outputs

The Ping action provides the following outputs:

Script result

The following table lists the value for the script result output when using the Ping action:

Reconnect Agent to the Network

Use the Reconnect Agent to the Network action to reconnect a disconnected endpoint to a network.

This action runs on the following Google SecOps entities:

• IP Address
• Hostname

Action inputs

None.

Action outputs

The Reconnect Agent to the Network action provides the following outputs:

Script result

The following table lists the value for the script result output when using the Reconnect Agent to the Network action:

Resolve Threat

Use the Resolve Threat action to resolve threats in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Resolve Threat action requires the following parameters:

Action outputs

The Resolve Threat action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Resolve Threat action:

[
    {
        "resolved": false,
        "Threat_ID": "THREAT_ID"
        }
]

Output messages

The Resolve Threat action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Resolve Threat action:

Update Analyst Verdict

Use the Update Analyst Verdict action to update the analyst verdict of the threat in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Update Analyst Verdict action requires the following parameters:

Action outputs

The Update Analyst Verdict action provides the following outputs:

Output messages

The Update Analyst Verdict action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Update Analyst Verdict action:

Update Incident Status

Use the Update Incident Status action to update threat incident status in SentinelOne.

This action doesn't run on Google SecOps entities.

Action inputs

The Update Incident Status action requires the following parameters:

Action outputs

The Update Incident Status action provides the following outputs:

Output messages

The Update Incident Status action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Update Incident Status action:

Connectors

For more detail about how to configure connectors in Google SecOps, see Ingest your data (connectors).

SentinelOne - Threats Connector

Use the SentinelOne - Threats Connector to ingest threats from SentinelOne.

The connector lets you filter alerts based on dynamic lists.

The SentinelOne - Threats Connector filters alerts using the alert_name parameter.

If you select the Use whitelist as a blacklist parameter, the connector only ingests alerts whose alert_name doesn't match any value in the dynamic list.

If you don't configure alert_name values in the dynamic list, the connector ingests all alerts.

If don't select the Use whitelist as a blacklist parameter, the connector only ingests alerts whose alert_name matches a value in the dynamic list.

Connector inputs

The SentinelOne - Threats Connector requires the following parameters:

Connector rules

The connector supports proxies.

The connector supports allowlist and blocklist.

Connector events

The example of the connector event is as follows:

{
    "data": [
        {
            "accountId": "ACCOUNT_ID",
            "accountName": "SentinelOne",
            "agentComputerName": "desktop-example",
            "agentDomain": "WORKGROUP",
            "agentId": "AGENT_ID",
            "agentInfected": false,
            "agentIp": "203.0.113.180",
            "agentIsActive": false,
            "agentIsDecommissioned": true,
            "agentMachineType": "desktop",
            "agentNetworkStatus": "connecting",
            "agentOsType": "windows",
            "agentVersion": "3.6.6.104",
            "annotation": null,
            "annotationUrl": null,
            "automaticallyResolved": false,
            "browserType": null,
            "certId": "",
            "classification": "generic.heuristic",
            "classificationSource": "Cloud",
            "classifierName": "MANUAL",
            "cloudVerdict": "provider_unknown",
            "collectionId": "COLLECTION_ID",
            "commandId": "835975626369402963",
            "createdAt": "2020-03-02T21:30:13.014874Z",
            "createdDate": "2020-03-02T21:30:12.748000Z",
            "description": "malware detected - not mitigated yet",
            "engines": [
                "manual"
            ],
            "fileContentHash": "fc5a9b5e806f35a7b285e012ef8df3f06f399492",
            "fileCreatedDate": null,
            "fileDisplayName": "example.exe",
            "fileExtensionType": "Executable",
            "fileIsDotNet": null,
            "fileIsExecutable": true,
            "fileIsSystem": false,
            "fileMaliciousContent": null,
            "fileObjectId": "99FF941D82E382D1",
            "filePath": "\\Device\\HarddiskVolume3\\Program Files\\example.exe",
            "fileSha256": null,
            "fileVerificationType": "NotSigned",
            "fromCloud": false,
            "fromScan": false,
            "id": "ID",
            "indicators": [],
            "initiatedBy": "dvCommand",
            "initiatedByDescription": "Deep Visibility Command",
            "initiatingUserId": "INITIATING_USER_ID",
            "isCertValid": false,
            "isInteractiveSession": false,
            "isPartialStory": false,
            "maliciousGroupId": "MALICED_GROUP_ID",
            "maliciousProcessArguments": "-ServerName:App.Example.mca",
            "markedAsBenign": false,
            "mitigationMode": "protect",
            "mitigationReport": {
                "kill": {
                    "status": "success"
                },
                "network_quarantine": {
                    "status": null
                },
                "quarantine": {
                    "status": "success"
                },
                "remediate": {
                    "status": null
                },
                "rollback": {
                    "status": null
                },
                "unquarantine": {
                    "status": null
                }
            },
            "mitigationStatus": "mitigated",
            "publisher": "",
            "rank": 2,
            "resolved": true,
            "siteId": "SITE_ID",
            "siteName": "Example.com",
            "threatAgentVersion": "3.6.6.104",
            "threatName": "example.exe",
            "updatedAt": "2020-04-02T14:51:21.901754Z",
            "username": "DESKTOP-example\\username",
            "whiteningOptions": [
                "hash"
            ]
        }
    ],
    "pagination": {
        "nextCursor": "VALUE",
        "totalItems": 161
    }
}

Need more help? Get answers from Community members and Google SecOps professionals.