> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> How to set up the SentinelOne connector, plus the actions that are available.

![SentinelOne](https://stackone-logos.com/api/sentinelone/filled/svg)

Betav0.2.0[See changelog](https://docs.stackone.com/connectors/sentinelone/changelog.md)

[69 actions](#actions) · 1 auth method

Security
IAM

## Getting Started

**1. Create or Select a Project**

Set up a new project or select an existing one. See [Organizations & Projects](https://docs.stackone.com/gateway/concepts/organizations-and-projects.md).

**2. Configure the Connector**

Enable the connector and create a Connector Profile in your project. See [Setup Connector Profile](https://docs.stackone.com/gateway/quickstart.md#setup-connector-profile).

> [card] [API Token · Connector Profile](https://docs.stackone.com/connectors/sentinelone/guides/connector-profile/api-token.md)
>
> No app registration required. The token carries the role and scope of its SentinelOne service user and stops working on...

**3. Link an Account**

Link an account [from the dashboard](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md#link-from-the-dashboard) (or via [StackOne Hub](https://docs.stackone.com/embed/account-linking/overview)).

See the guide for the authentication type chosen in the Connector Profile:

> [card] [API Token · Link Account](https://docs.stackone.com/connectors/sentinelone/guides/link-account/api-token.md)

**4. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Actions

69 actions

ActionDescription

List Accounts`sentinelone_get_accounts`

List the SentinelOne accounts the token can see.

Get Account`sentinelone_get_account`

Get a SentinelOne account by ID.

List Activities`sentinelone_get_activities`

List console and agent activity records, the audit trail of the SentinelOne tenant.

List Activity Types`sentinelone_get_activity_types`

List the activity type codes used by SentinelOne, with the description of each.

Initiate Agent Scan`sentinelone_initiate_agent_scan`

Start a full disk scan on the selected endpoints.

Abort Agent Scan`sentinelone_abort_agent_scan`

Stop a running full disk scan on the selected endpoints.

Disconnect Agents From Network`sentinelone_disconnect_agents_from_network`

Isolate the selected endpoints from the network.

Connect Agents To Network`sentinelone_connect_agents_to_network`

Return the selected endpoints to the network after isolation.

Restart Agents`sentinelone_restart_agents`

Restart the machines behind the selected endpoints.

Shut Down Agents`sentinelone_shutdown_agents`

Shut down the machines behind the selected endpoints.

Uninstall Agents`sentinelone_uninstall_agents`

Uninstall the SentinelOne agent from the selected endpoints.

Decommission Agents`sentinelone_decommission_agents`

Decommission the selected endpoints and remove them from the console.

Mark Agents Up To Date`sentinelone_mark_agents_up_to_date`

Mark the selected agents as running an up to date version.

Approve Agent Uninstall`sentinelone_approve_agent_uninstall`

Approve pending uninstall requests from the selected endpoints.

Reject Agent Uninstall`sentinelone_reject_agent_uninstall`

Reject pending uninstall requests from the selected endpoints.

Fetch Agent Installed Applications`sentinelone_get_agent_installed_applications`

Ask the selected endpoints to report their installed applications.

Fetch Agent Logs`sentinelone_fetch_agent_logs`

Collect diagnostic logs from the selected endpoints.

Set Agent External ID`sentinelone_set_agent_external_id`

Set the customer identifier shown on the selected endpoints.

Move Agents To Site`sentinelone_move_agents_to_site`

Move the selected endpoints to another site.

Update Agent Software`sentinelone_update_agent_software`

Update the SentinelOne agent version on the selected endpoints.

Manage Agent Tags`sentinelone_manage_agent_tags`

Add, remove or override endpoint tags on the selected endpoints.

List Agents`sentinelone_get_agents`

List the SentinelOne agents installed on managed endpoints.

Count Agents`sentinelone_count_agents`

Count the agents that match a filter, without returning the agents themselves.

List Agent Applications`sentinelone_list_agent_applications`

List the applications installed on specific endpoints.

Create Agent Tag`sentinelone_create_agent_tag`

Create an endpoint tag that can then be attached to agents.

List Agent Tags`sentinelone_get_agent_tags`

List the endpoint tags defined in the tenant.

List Groups`sentinelone_get_groups`

List the endpoint groups in the SentinelOne tenant.

Get Group`sentinelone_get_group`

Get one SentinelOne endpoint group by ID.

Get Group Registration Token`sentinelone_get_group_registration_token`

Get the registration token that enrols new agents straight into a group.

Create Group`sentinelone_create_group`

Create an endpoint group inside a site.

Update Group`sentinelone_update_group`

Update a SentinelOne endpoint group.

Delete Group`sentinelone_delete_group`

Delete a SentinelOne endpoint group.

Move Agents To Group`sentinelone_move_agents_to_group`

Move selected agents into an endpoint group.

Get Unified Credentials`sentinelone_unified_get_me`

Get the current SentinelOne connection's unified credentials and identity.

List Unified Organizations`sentinelone_unified_list_organizations`

List unified organizations in a SentinelOne console.

Get Unified Organization`sentinelone_unified_get_organization`

Get a unified SentinelOne organization by ID.

List Unified Roles`sentinelone_unified_list_roles`

List unified roles in a SentinelOne console.

Get Unified Role`sentinelone_unified_get_role`

Get a unified SentinelOne role by ID.

List Unified Users`sentinelone_unified_list_users`

List unified users in a SentinelOne console.

Get Unified User`sentinelone_unified_get_user`

Get a unified SentinelOne user by ID.

List Roles`sentinelone_get_roles`

List the roles defined in a SentinelOne console.

Get Role`sentinelone_get_role`

Get a SentinelOne role definition by ID.

List Service Users`sentinelone_get_service_users`

List the SentinelOne service users, the API-only identities.

Get Service User`sentinelone_get_service_user`

Get a SentinelOne service user by ID.

List Sites`sentinelone_get_sites`

List the sites in the SentinelOne tenant.

Get Site`sentinelone_get_site`

Get one SentinelOne site by ID.

Get Site Registration Token`sentinelone_get_site_registration_token`

Get the registration token that enrols new agents into a site.

Create Site`sentinelone_create_site`

Create a site in the SentinelOne tenant.

Update Site`sentinelone_update_site`

Update a SentinelOne site.

Delete Site`sentinelone_delete_site`

Delete a SentinelOne site.

List Threat Notes`sentinelone_get_threat_notes`

List the analyst notes recorded against one threat.

Create Threat Note`sentinelone_add_threat_note`

Add an analyst note to the selected threats.

Update Threat Note`sentinelone_update_threat_note`

Change the text of one analyst note on a threat.

Delete Threat Note`sentinelone_delete_threat_note`

Delete one analyst note from a threat.

List Threats`sentinelone_get_threats`

List the threats SentinelOne has detected on managed endpoints.

Get Threat Timeline`sentinelone_get_threat_timeline`

Get the ordered history of what happened to one threat.

List Threat Events`sentinelone_get_threat_events`

List the endpoint events recorded around one threat.

Get Threat Exclusion Options`sentinelone_exclusion_options`

Get the exclusion types that can be created from one threat's detection data.

Mitigate Threats`sentinelone_mitigate_threats`

Apply a mitigation action to the selected threats.

Update Threat Analyst Verdict`sentinelone_update_threat_analyst_verdict`

Record the analyst's judgement on the selected threats.

Update Threat Incident Status`sentinelone_update_threat_incident_status`

Move the selected threats through the triage workflow.

Update Threat External Ticket ID`sentinelone_update_threat_external_ticket_id`

Link the selected threats to a ticket in another system.

Add Threats To Blocklist`sentinelone_add_threats_to_blocklist`

Block the file hashes behind the selected threats across a scope.

Add Threats To Exclusions`sentinelone_add_threats_to_exclusions`

Create an exclusion from the selected threats so SentinelOne stops flagging them.

Fetch Threat File`sentinelone_fetch_threat_file`

Retrieve the file behind the selected threats for offline analysis.

List Users`sentinelone_list_users`

List the users who can sign in to the SentinelOne console.

Get User`sentinelone_get_user`

Get a SentinelOne console user by ID.

Get Current User`sentinelone_user_by_token`

Get the user that owns the connection API token.

Check Connection`sentinelone_check_connection`

Check that the API token can read users from the SentinelOne console.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.