SentinelOne

Connect your own SentinelOne Singularity tenant (Management Console URL + API Token), verifying the credentials with a real call before saving.

List the connected SentinelOne tenants.

Disconnect a SentinelOne tenant: deletes the saved console URL/API token. Nothing in SentinelOne itself is changed.

List SentinelOne threats on the connected tenant, optionally filtered to resolved/unresolved only.

Read one SentinelOne threat in full by id.

Apply a mitigation action to a SentinelOne threat: kill, quarantine, remediate, rollback-remediation, or un-quarantine. rollback-remediation is DESTRUCTIVE and irreversible -- it restores the affected filesystem to its state before infection.

List agents (endpoints) enrolled in the connected SentinelOne tenant.

Isolate a SentinelOne agent from the network (network quarantine). The agent stays protected but loses almost all network access -- confirm the target host before running.

Reconnect a previously isolated SentinelOne agent back to the network.

Trigger an on-demand full disk scan on a SentinelOne agent.

List Exclusions (allowlisted hashes/paths/certificates) configured on the connected SentinelOne tenant.

Create a new Exclusion (allowlist entry) on the connected SentinelOne tenant -- e.g. a known-good file hash or path.

Permanently delete an Exclusion from the connected SentinelOne tenant. Cannot be undone.

Start a Deep Visibility query (SentinelOne's fleet-wide threat hunting engine) against the connected tenant's telemetry. Returns a query_id -- fetch results with get_deep_visibility_results once it finishes running.

Read the results of a previously started Deep Visibility query by its query_id.

Build one aggregated health report across the connected SentinelOne tenant: active (unresolved) threats, infected agents, and inactive agents.