Skip to main content

​
Basic Parameters​

ParameterDescription
Alert IDsFilter by a list of alert IDs.
Analyst VerdictFilter alerts by an analyst verdict.Options: FALSE_POSITIVE SUSPICIOUS TRUE_POSITIVE UNDEFINED
Count OnlyIf true, only total number of items will be returned, without any of the actual objects.
Created AfterCreated after a specified timestamp.
Created BeforeCreated before a specified timestamp.
CursorCursor position returned by the last request. Use to iterate over more than 1000 items. Example: “YWdlbnRfaWQ6NTgwMjkzODE=”.
Incident StatusFilter alerts by a incident status. Options: IN_PROGRESS RESOLVED UNRESOLVED
LimitLimit number of returned items (1-1000). Example: 10.
Return All PagesAutomatically fetch all resources, page by page.
Sort ByThe column to sort the results by.

​
Advanced Parameters​

ParameterDescription
Account IDsList of account IDs to filter by. Example: 225494730938493804,225494730938493915.

​
Example Output​

{    "errors": [        {            "type": "object"        }    ],    "pagination": {        "nextCursor": "YWdlbnRfaWQ6NTgwMjkzODE=",        "totalItems": 580    },    "data": [        {            "sourceParentProcessInfo": {                "fileHashSha256": "string",                "subsystem": "unknown",                "uniqueId": "string",                "fileSignerIdentity": "string",                "integrityLevel": "unknown",                "pid": "string",                "filePath": "string",                "effectiveUser": "string",                "fileHashSha1": "string",                "pidStarttime": "2018-02-27T04:49:26.257525Z",                "fileHashMd5": "string",                "realUser": "string",                "loginUser": "string",                "storyline": "string",                "commandline": "string",                "name": "string",                "user": "string"            },            "ruleInfo": {                "severity": "Low",                "id": "string",                "s1ql": "string",                "scopeLevel": "group",                "treatAsThreat": "UNDEFINED",                "queryLang": "1.0",                "description": "string",                "queryType": "events",                "name": "string"            },            "alertInfo": {                "dnsResponse": "string",                "moduleSha1": "string",                "indicatorCategory": "string",                "incidentStatus": "Unresolved",                "tiIndicatorValue": "string",                "netEventDirection": "string",                "loginAccountSid": "string",                "hitType": "Events",                "modulePath": "string",                "indicatorDescription": "string",                "indicatorName": "string",                "dstPort": "string",                "isEdr": "boolean",                "analystVerdict": "Undefined",                "srcMachineIp": "string",                "registryKeyPath": "string",                "registryOldValueType": "string",                "tiIndicatorComparisonMethod": "string",                "registryPath": "string",                "registryValue": "string",                "loginIsAdministratorEquivalent": "string",                "loginAccountDomain": "string",                "reportedAt": "2018-02-27T04:49:26.257525Z",                "dnsRequest": "string",                "loginType": "string",                "registryOldValue": "string",                "srcIp": "string",                "updatedAt": "2018-02-27T04:49:26.257525Z",                "tiIndicatorSource": "string",                "source": "string",                "eventType": "string",                "tiIndicatorType": "string",                "dstIp": "string",                "loginsUserName": "string",                "createdAt": "2018-02-27T04:49:26.257525Z",                "loginIsSuccessful": "string",                "dvEventId": "string",                "srcPort": "string",                "alertId": "225494730938493804"            },            "targetProcessInfo": {                "tgtFileCreatedAt": "2018-02-27T04:49:26.257525Z",                "tgtProcSignedStatus": "string",                "tgtFilePath": "string",                "tgtFileHashSha256": "string",                "tgtFileModifiedAt": "2018-02-27T04:49:26.257525Z",                "tgtProcName": "string",                "tgtProcImagePath": "string",                "tgtFileHashSha1": "string",                "tgtFileIsSigned": "string",                "tgtProcStorylineId": "string",                "tgtProcPid": "string",                "tgtProcIntegrityLevel": "unknown",                "tgtProcCmdLine": "string",                "tgtFileId": "string",                "tgtProcUid": "string",                "tgtProcessStartTime": "2018-02-27T04:49:26.257525Z",                "tgtFileOldPath": "string"            },            "containerInfo": {                "labels": "string",                "name": "string",                "id": "string",                "image": "string"            },            "kubernetesInfo": {                "podLabels": "string",                "pod": "string",                "controllerKind": "string",                "namespace": "string",                "controllerLabels": "string",                "controllerName": "string",                "node": "string",                "namespaceLabels": "string",                "cluster": "string"            },            "sourceProcessInfo": {                "fileHashSha256": "string",                "subsystem": "unknown",                "uniqueId": "string",                "fileSignerIdentity": "string",                "integrityLevel": "unknown",                "pid": "string",                "filePath": "string",                "effectiveUser": "string",                "fileHashSha1": "string",                "pidStarttime": "2018-02-27T04:49:26.257525Z",                "fileHashMd5": "string",                "realUser": "string",                "loginUser": "string",                "storyline": "string",                "commandline": "string",                "name": "string",                "user": "string"            },            "agentDetectionInfo": {                "osName": "string",                "osRevision": "string",                "accountId": "225494730938493804",                "version": "3.6.1.14",                "machineType": "string",                "siteId": "225494730938493804",                "osFamily": "string",                "uuid": "string",                "name": "string"            }        }    ]}

​
Workflow Library Example​

Get Alerts with Sentinelone and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop