Getting Started
1
Create or Select a Project
Set up a new project or select an existing one. See Organizations & Projects.
2
Configure the Connector
Enable the connector and create a Connector Profile in your project. See Setup Connector Profile.
API Token · Connector Profile
No app registration required. The token carries the role and scope of its SentinelOne service user and stops working on…
3
Link an Account
Link an account from the dashboard (or via StackOne Hub).See the guide for the authentication type chosen in the Connector Profile:
API Token · Link Account
4
Use Actions
Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.
Actions
69 actions
Action
Description
List Accounts
List the SentinelOne accounts the token can see.
Get Account
Get a SentinelOne account by ID.
List Activities
List console and agent activity records, the audit trail of the SentinelOne tenant.
List Activity Types
List the activity type codes used by SentinelOne, with the description of each.
Initiate Agent Scan
Start a full disk scan on the selected endpoints.
Abort Agent Scan
Stop a running full disk scan on the selected endpoints.
Disconnect Agents From Network
Isolate the selected endpoints from the network.
Connect Agents To Network
Return the selected endpoints to the network after isolation.
Restart Agents
Restart the machines behind the selected endpoints.
Shut Down Agents
Shut down the machines behind the selected endpoints.
Uninstall Agents
Uninstall the SentinelOne agent from the selected endpoints.
Decommission Agents
Decommission the selected endpoints and remove them from the console.
Mark Agents Up To Date
Mark the selected agents as running an up to date version.
Approve Agent Uninstall
Approve pending uninstall requests from the selected endpoints.
Reject Agent Uninstall
Reject pending uninstall requests from the selected endpoints.
Fetch Agent Installed Applications
Ask the selected endpoints to report their installed applications.
Fetch Agent Logs
Collect diagnostic logs from the selected endpoints.
Set Agent External ID
Set the customer identifier shown on the selected endpoints.
Move Agents To Site
Move the selected endpoints to another site.
Update Agent Software
Update the SentinelOne agent version on the selected endpoints.
Manage Agent Tags
Add, remove or override endpoint tags on the selected endpoints.
List Agents
List the SentinelOne agents installed on managed endpoints.
Count Agents
Count the agents that match a filter, without returning the agents themselves.
List Agent Applications
List the applications installed on specific endpoints.
Create Agent Tag
Create an endpoint tag that can then be attached to agents.
List Agent Tags
List the endpoint tags defined in the tenant.
List Groups
List the endpoint groups in the SentinelOne tenant.
Get Group
Get one SentinelOne endpoint group by ID.
Get Group Registration Token
Get the registration token that enrols new agents straight into a group.
Create Group
Create an endpoint group inside a site.
Update Group
Update a SentinelOne endpoint group.
Delete Group
Delete a SentinelOne endpoint group.
Move Agents To Group
Move selected agents into an endpoint group.
Get Unified Credentials
Get the current SentinelOne connection’s unified credentials and identity.
List Unified Organizations
List unified organizations in a SentinelOne console.
Get Unified Organization
Get a unified SentinelOne organization by ID.
List Unified Roles
List unified roles in a SentinelOne console.
Get Unified Role
Get a unified SentinelOne role by ID.
List Unified Users
List unified users in a SentinelOne console.
Get Unified User
Get a unified SentinelOne user by ID.
List Roles
List the roles defined in a SentinelOne console.
Get Role
Get a SentinelOne role definition by ID.
List Service Users
List the SentinelOne service users, the API-only identities.
Get Service User
Get a SentinelOne service user by ID.
List Sites
List the sites in the SentinelOne tenant.
Get Site
Get one SentinelOne site by ID.
Get Site Registration Token
Get the registration token that enrols new agents into a site.
Create Site
Create a site in the SentinelOne tenant.
Update Site
Update a SentinelOne site.
Delete Site
Delete a SentinelOne site.
List Threat Notes
List the analyst notes recorded against one threat.
Create Threat Note
Add an analyst note to the selected threats.
Update Threat Note
Change the text of one analyst note on a threat.
Delete Threat Note
Delete one analyst note from a threat.
List Threats
List the threats SentinelOne has detected on managed endpoints.
Get Threat Timeline
Get the ordered history of what happened to one threat.
List Threat Events
List the endpoint events recorded around one threat.
Get Threat Exclusion Options
Get the exclusion types that can be created from one threat’s detection data.
Mitigate Threats
Apply a mitigation action to the selected threats.
Update Threat Analyst Verdict
Record the analyst’s judgement on the selected threats.
Update Threat Incident Status
Move the selected threats through the triage workflow.
Update Threat External Ticket ID
Link the selected threats to a ticket in another system.
Add Threats To Blocklist
Block the file hashes behind the selected threats across a scope.
Add Threats To Exclusions
Create an exclusion from the selected threats so SentinelOne stops flagging them.
Fetch Threat File
Retrieve the file behind the selected threats for offline analysis.
List Users
List the users who can sign in to the SentinelOne console.
Get User
Get a SentinelOne console user by ID.
Get Current User
Get the user that owns the connection API token.
Check Connection
Check that the API token can read users from the SentinelOne console.