SentinelOne

The SentinelOne Connector app allows security teams to integrate with the SentinelOne enterprise application for computer network endpoint security by managing sites, threats, blacklist items, and hash.

Supported Actions and Example Prompts

The following table lists the supported actions and prompt examples for an action:

Action Name	Description	Prompt Example
Create Query	This action creates a query. For more information, see Action: Create Query.	Create a query for AgentName IS NOT EMPTY from 2018-02-27T04:49:26.257525Z to 2018-02-28T04:49:26.257525Z using SentinelOne.
Get Event by Type	This action retrieves a list of events of a specific type. For more information, see Action: Get Event by Type (Beta).	Get Events of the type Process Exitfrom SentinelOne.
Get Query Events	This action retrieves a list of query events. For more information, see Action: Get Query Events.	Get query events of q1652233 from SentinelOne.
Quarantine Machine	This action quarantines a machine from the rest of the network. For more information, see Action: Quarantine Machine.	Quarantine machine with the rule category as possible threats and threat IDs ["1234999", "23456888"].

Install and Configure the App

Install and configure the required apps to enable Quarterback AI to perform various security-related tasks and provide relevant responses. After installing an app, you must create an instance that will be used to communicate with the app endpoints. An app can have multiple instances, and you can set a default instance from the configured instance list.

Before you Start

Ensure that you have the API token to authenticate with the SentinelOne app.

Steps

To install and configure an app, follow these steps:

Go to the application, in the left pane, select Quarterback AI.
In Apps, select SentinelOne and click Install.
After the app is installed, click Configure and enter the following details to create an instance:
- Instance Name: Enter a name for the instance.
- Instance Description: Enter a description for the instance.
- Expiry: Select an expiry date for the instance.
- Set as default instance: Select this option to set this instance as the default instance. By default, this instance will be used to perform actions from this app.
- Base URL: Enter the base URL of the SentinelOne management console. For example, your-subdomain.sentinelone.net.
- API token: Enter the API token for accessing the SentinelOne management console REST API.
- SSL/TLS Verify: Select this option to verify SSL while making requests. It is recommended to select this option to ensure a secure connection. By default, this option is not selected.
- Timeout: Enter the timeout value in seconds. This is the number of seconds that requests will wait to establish a connection with AbuseIPDB. You can enter values between 15 - 120 seconds. By default, 15 seconds is set.
Click Done.

The instance is created, and you can view it in Instances. To create another instance, click Add Instance.

Action: Create Query

This action creates a query.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional
From Date	Enter the date and time to create events after this timestamp. Example: 2018-02-27T04:49:26.257525Z	Text	Required
To Date	Enter the date and time to create events before this timestamp. Example: 2018-02-28T04:49:26.257525Z	Text	Required
Query	Enter the query to retrieve the matching events. Example: AgentName IS NOT EMPTY	Text	Required
Data	Enter the details to add to the query. Example: $JSON[{"isVerbose": true,"accountIds": ["225494730938493804"]}]	Key Value	Optional

Example Request

[    
	{        
		"from_date": "2018-02-27T04:49:26.257525Z ",        
		"to_date": "2018-02-28T04:49:26.257525Z ",        
		"query": "AgentName IS NOT EMPTY",        
		"data": 
			{            
				"isVerbose":true,            
				"accountIds": ["225494730938493804"]        
			}    
	} 
]

Action Response Parameters

Parameters	Field Type	Description
`app_instance.response.data`	Object	The response data
`app_instance.response.data.queryId`	String	The unique identifier of the query
`app_instance.response.data.queryModeInfo`	Object	The info on the mode of the query
`app_instance.response.data.queryModeInfo.mode`	String	The query mode
`app_instance.response.data.queryModeInfo.lastActivatedAt`	String	The last activated date of the query modee
`app_instance.response.data.errors`	Array	Errors

Action: Get Event by Type (Beta)

This action retrieves a list of events of a specific type.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Event Type	Enter an event type. Example: "Process Exit"	Text	Required
Query ID	Enter the query ID to retrieve the result. Example: "q1652233"	Text	Required
Query Parameters	Enter the query parameters to narrow down the result. Example: {"limit":10}	Key Value	Optional	Allowed keys: sortBy sortOrder cursor limit skip

Parameter

Description

Field Type

Required/Optional

Comments

Event Type

Enter an event type.

Example:

"Process Exit"

Text

Required

Query ID

Enter the query ID to retrieve the result.

Example:

"q1652233"

Text

Required

Query Parameters

Enter the query parameters to narrow down the result.

Example:

{"limit":10}

Key Value

Optional

Allowed keys:

sortBy
sortOrder
cursor
limit
skip

Example Request

[
    {
        "event_type": "Process Exit",
        "query_id": "q1652233" 
        "query_param": {
            "limit":10
        }
    }
]

Action Response Parameters

Parameter	Field Type	Description
`{app_instance}`	JSON Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
`app_instance.response`	JSON Object	Includes the response received from the app action.
`app_instance.response.data.agentDomain`	String	Agent domain
`app_instance.response.data.agentGroupId`	String	Agent group id
`app_instance.response.data.agentId`	String	Agent id
`app_instance.response.data.agentInfected`	Boolean	Agent infected
`app_instance.response.data.agentIp`	String	Agent ip
`app_instance.response.data.agentIsActive`	Boolean	Agent is active
`app_instance.response.data.agentIsDecommissioned`	Boolean	Agent is decommissioned
`app_instance.response.data.agentMachineType`	String	Agent machine type
`app_instance.response.data.agentName`	String	Agent name
`app_instance.response.data.agentNetworkStatus`	String	Agent network status
`app_instance.response.data.agentOs`	Enum	OS type
`app_instance.response.data.agentUuid`	String	Agent uuid
`app_instance.response.data.agentVersion`	String	Agent version
`app_instance.response.data.createdAt`	String	Created at
`app_instance.response.data.id`	String	Id
`app_instance.response.data.objectType`	String	Object type
`app_instance.response.data.processName`	String	Process name
`app_instance.response.data.siteName`	String	Site name
`app_instance.response.data.user`	String	User
`app_instance.response.data.connectionStatus`	String	Connection status
`app_instance.response.data.direction`	String	Direction
`app_instance.response.data.dnsRequest`	String	Dns request
`app_instance.response.data.dnsResponse`	String	Dns response
`app_instance.response.data.dstIp`	String	Dst ip
`app_instance.response.data.dstPort`	Integer	Dst port
`app_instance.response.data.eventType`	String	Event type
`app_instance.response.data.fileFullName`	String	File full name
`app_instance.response.data.fileId`	String	File id
`app_instance.response.data.fileMd5`	String	File md5
`app_instance.response.data.fileSha1`	String	File sha1
`app_instance.response.data.fileSha256`	String	File sha256
`app_instance.response.data.fileSize`	String	File size
`app_instance.response.data.fileType`	String	File type
`app_instance.response.data.forensicUrl`	String	Forensic url
`app_instance.response.data.indicatorCategory`	String	Indicator category
`app_instance.response.data.indicatorDescription`	String	Indicator description
`app_instance.response.data.indicatorMetadata`	String	Indicator metadata
`app_instance.response.data.indicatorName`	String	Indicator name
`app_instance.response.data.isAgentVersionFullySupportedForPg`	Boolean	Is agent version fully supported for pg
`app_instance.response.data.isAgentVersionFullySupportedForPgMessage`	String	Is agent version fully supported for pg message
`app_instance.response.data.loginsBaseType`	String	Logins base type
`app_instance.response.data.loginsUserName`	String	Logins user name
`app_instance.response.data.md5`	String	Md5
`app_instance.response.data.networkMethod`	String	Network method
`app_instance.response.data.networkSource`	String	Network source
`app_instance.response.data.networkUrl`	String	Network url
`app_instance.response.data.oldFileMd5`	String	Old file md5
`app_instance.response.data.oldFileName`	String	Old file name
`app_instance.response.data.oldFileSha1`	String	Old file sha1
`app_instance.response.data.oldFileSha256`	String	Old file sha256
`app_instance.response.data.parentPid`	String	Parent pid
`app_instance.response.data.parentProcessGroupId`	String	Parent process group id
`app_instance.response.data.parentProcessIsMalicious`	Boolean	Parent process is malicious
`app_instance.response.data.parentProcessName`	String	Parent process name
`app_instance.response.data.parentProcessStartTime`	String	Parent process start time
`app_instance.response.data.parentProcessUniqueKey`	String	Parent process unique key
`app_instance.response.data.pid`	String	Pid
`app_instance.response.data.processCmd`	String	Process cmd
`app_instance.response.data.processDisplayName`	String	Process display name
`app_instance.response.data.processGroupId`	String	Process group id
`app_instance.response.data.processImagePath`	String	Process image path
`app_instance.response.data.processImageSha1Hash`	String	Process image sha1 hash
`app_instance.response.data.processIntegrityLevel`	String	Process integrity level
`app_instance.response.data.processIsMalicious`	Boolean	Process is malicious
`app_instance.response.data.processIsRedirectedCommandProcessor`	String	Process is redirected command processor
`app_instance.response.data.processIsWow64`	String	Process is wow64
`app_instance.response.data.processRoot`	String	Process root
`app_instance.response.data.processSessionId`	String	Process session id
`app_instance.response.data.processStartTime`	String	Process start time
`app_instance.response.data.processSubSystem`	String	Process sub system
`app_instance.response.data.processUniqueKey`	String	Process unique key
`app_instance.response.data.processUserName`	String	Process user name
`app_instance.response.data.publisher`	String	Publisher
`app_instance.response.data.registryId`	String	Registry id
`app_instance.response.data.registryPath`	String	Registry path
`app_instance.response.data.relatedToThreat`	String	Related to threat
`app_instance.response.data.rpid`	String	Rpid
`app_instance.response.data.sha1`	String	Sha1
`app_instance.response.data.sha256`	String	Sha256
`app_instance.response.data.signatureSignedInvalidReason`	String	Signature signed invalid reason
`app_instance.response.data.signedStatus`	String	Signed status
`app_instance.response.data.srcIp`	String	Src ip
`app_instance.response.data.srcPort`	Integer	Src port
`app_instance.response.data.srcProcDownloadToken`	String	Src proc download token
`app_instance.response.data.taskName`	String	Task name
`app_instance.response.data.taskPath`	String	Task path
`app_instance.response.data.threatStatus`	String	Threat status
`app_instance.response.data.tid`	String	Tid
`app_instance.response.data.trueContext`	String	True context
`app_instance.response.data.verifiedStatus`	String	Verified status
`app_instance.response.errors`	Array	Errors

Action: Get Query Events

This action retrieves a list of query events.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Query ID	Enter the query ID to retrieve the events. Example: "q1652233"	Text	Required
Query Parameters	Enter the query parameters to narrow down the result. Example: {"limit":10}	Key Value	Optional	Allowed keys: sortBy sortOrder cursor limit skip

Parameter

Description

Field Type

Required/Optional

Comments

Query ID

Enter the query ID to retrieve the events.

Example:

"q1652233"

Text

Required

Query Parameters

Enter the query parameters to narrow down the result.

Example:

{"limit":10}

Key Value

Optional

Allowed keys:

sortBy
sortOrder
cursor
limit
skip

Example Request

[
    {
        "query_id": "q1652233" 
        "query_param": {
            "limit":10
        }
    }
]

Action Response Parameters

Parameter	Field Type	Description
`{app_instance}`	JSON Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
`app_instance.response`	JSON Object	Includes the response received from the app action.
`app_instance.response.data.agentDomain`	String	Agent domain
`app_instance.response.data.agentGroupId`	String	Agent group id
`app_instance.response.data.agentId`	String	Agent id
`app_instance.response.data.agentInfected`	Boolean	Agent infected
`app_instance.response.data.agentIp`	String	Agent ip
`app_instance.response.data.agentIsActive`	Boolean	Agent is active
`app_instance.response.data.agentIsDecommissioned`	Boolean	Agent is decommissioned
`app_instance.response.data.agentMachineType`	String	Agent machine type
`app_instance.response.data.agentName`	String	Agent name
`app_instance.response.data.agentNetworkStatus`	String	Agent network status
`app_instance.response.data.agentOs`	Enum	OS type
`app_instance.response.data.agentUuid`	String	Agent uuid
`app_instance.response.data.agentVersion`	String	Agent version
`app_instance.response.data.createdAt`	String	Created at
`app_instance.response.data.id`	String	Id
`app_instance.response.data.objectType`	String	Object type
`app_instance.response.data.processName`	String	Process name
`app_instance.response.data.siteName`	String	Site name
`app_instance.response.data.user`	String	User
`app_instance.response.data.connectionStatus`	String	Connection status
`app_instance.response.data.direction`	String	Direction
`app_instance.response.data.dnsRequest`	String	Dns request
`app_instance.response.data.dnsResponse`	String	Dns response
`app_instance.response.data.dstIp`	String	Dst ip
`app_instance.response.data.dstPort`	Integer	Dst port
`app_instance.response.data.eventType`	String	Event type
`app_instance.response.data.fileFullName`	String	File full name
`app_instance.response.data.fileId`	String	File id
`app_instance.response.data.fileMd5`	String	File md5
`app_instance.response.data.fileSha1`	String	File sha1
`app_instance.response.data.fileSha256`	String	File sha256
`app_instance.response.data.fileSize`	String	File size
`app_instance.response.data.fileType`	String	File type
`app_instance.response.data.forensicUrl`	String	Forensic url
`app_instance.response.data.indicatorCategory`	String	Indicator category
`app_instance.response.data.indicatorDescription`	String	Indicator description
`app_instance.response.data.indicatorMetadata`	String	Indicator metadata
`app_instance.response.data.indicatorName`	String	Indicator name
`app_instance.response.data.isAgentVersionFullySupportedForPg`	Boolean	Is agent version fully supported for pg
`app_instance.response.data.isAgentVersionFullySupportedForPgMessage`	String	Is agent version fully supported for pg message
`app_instance.response.data.loginsBaseType`	String	Logins base type
`app_instance.response.data.loginsUserName`	String	Logins user name
`app_instance.response.data.md5`	String	Md5
`app_instance.response.data.networkMethod`	String	Network method
`app_instance.response.data.networkSource`	String	Network source
`app_instance.response.data.networkUrl`	String	Network url
`app_instance.response.data.oldFileMd5`	String	Old file md5
`app_instance.response.data.oldFileName`	String	Old file name
`app_instance.response.data.oldFileSha1`	String	Old file sha1
`app_instance.response.data.oldFileSha256`	String	Old file sha256
`app_instance.response.data.parentPid`	String	Parent pid
`app_instance.response.data.parentProcessGroupId`	String	Parent process group id
`app_instance.response.data.parentProcessIsMalicious`	Boolean	Parent process is malicious
`app_instance.response.data.parentProcessName`	String	Parent process name
`app_instance.response.data.parentProcessStartTime`	String	Parent process start time
`app_instance.response.data.parentProcessUniqueKey`	String	Parent process unique key
`app_instance.response.data.pid`	String	Pid
`app_instance.response.data.processCmd`	String	Process cmd
`app_instance.response.data.processDisplayName`	String	Process display name
`app_instance.response.data.processGroupId`	String	Process group id
`app_instance.response.data.processImagePath`	String	Process image path
`app_instance.response.data.processImageSha1Hash`	String	Process image sha1 hash
`app_instance.response.data.processIntegrityLevel`	String	Process integrity level
`app_instance.response.data.processIsMalicious`	Boolean	Process is malicious
`app_instance.response.data.processIsRedirectedCommandProcessor`	String	Process is redirected command processor
`app_instance.response.data.processIsWow64`	String	Process is wow64
`app_instance.response.data.processRoot`	String	Process root
`app_instance.response.data.processSessionId`	String	Process session id
`app_instance.response.data.processStartTime`	String	Process start time
`app_instance.response.data.processSubSystem`	String	Process sub system
`app_instance.response.data.processUniqueKey`	String	Process unique key
`app_instance.response.data.processUserName`	String	Process user name
`app_instance.response.data.publisher`	String	Publisher
`app_instance.response.data.registryId`	String	Registry id
`app_instance.response.data.registryPath`	String	Registry path
`app_instance.response.data.relatedToThreat`	String	Related to threat
`app_instance.response.data.rpid`	String	Rpid
`app_instance.response.data.sha1`	String	Sha1
`app_instance.response.data.sha256`	String	Sha256
`app_instance.response.data.signatureSignedInvalidReason`	String	Signature signed invalid reason
`app_instance.response.data.signedStatus`	String	Signed status
`app_instance.response.data.srcIp`	String	Src ip
`app_instance.response.data.srcPort`	Integer	Src port
`app_instance.response.data.srcProcDownloadToken`	String	Src proc download token
`app_instance.response.data.taskName`	String	Task name
`app_instance.response.data.taskPath`	String	Task path
`app_instance.response.data.threatStatus`	String	Threat status
`app_instance.response.data.tid`	String	Tid
`app_instance.response.data.trueContext`	String	True context
`app_instance.response.data.verifiedStatus`	String	Verified status
`app_instance.response.errors`	Array	Errors

Action: Quarantine Machine

This action quarantines a machine from the rest of the network based on a rule category and threat IDs.

Action Input Parameters

Parameter	Description	Field Type	Required/Optional	Comments
Rule Category	Enter the rule category. Example: possible threats	Text	Required
Threat IDs	Enter the threat IDs in a comma separated list. Example: ["1234999", "23456888"]	List	Required
Tag IDs	Enter the list of tag ids. Example: [tag1,tag2]	List	Required
Extra Filters	Enter any additional filters as key-value pairs to quarantine a machine.	Key Value	Optional	Allowed values: 'createdAt__between', 'locationIds', 'enum', 'createdAt__lte', 'accountIds', 'name__contains', 'createdAt__gt', 'createdAt__lt', 'application__contains', 'minLength', 'directions', 'query', 'actions', 'protocols', 'description', 'groupIds', 'createdAt__gte', 'osTypes', 'protocol__contains', 'applications', 'service__contains', 'siteIds', 'minimum', 'tenant', 'name', 'scopes', 'statuses', 'tagName__contains'], 'tag_ids'

Example Request

[
    {
        "threat_ids": "1194559565660255827",
        "tag_ids": "tag1256",
        "rule_category": "possiblethreats"
        "extra_filters": {
            “groupIds”: “group123”
        }
    }
]

Action Response Parameters

Parameter	Field Type	Description
`{app_instance}`	JSON Object	This parameter indicates the ID of the app instance configured in Orchestrate from which the response is retrieved.
`app_instance.response`	JSON Object	Includes the response received from the app action.
`app_instance.response.data`	JSON Object	Response data from SentinelOne.
`app_instance.response.data.affected`	Integer	Number of machines affected by the requested operation.
`app_instance.response.errors`	Array	Errors received from SentinelOne.
`app_instance.status`	String	HTTP status code of the API request received from the app instance. For more information, see List of HTTP status codes.

Quarterback AI

SentinelOne

Install and Configure the App

Action: Create Query

Action: Get Event by Type (Beta)

Action: Get Query Events

Action: Quarantine Machine

Search results