SentinelOne

• New threatRuns when SentinelOne detects a threat on an endpoint, with the threat, its file and hashes, what was done about it and the endpoint. Threats detected before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• Threat status changedRuns when a threat's incident status, mitigation status or analyst verdict changes, such as when it is resolved or marked a false positive, with the threat as it is now. Changes made before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• New alertRuns when a STAR custom detection rule raises an alert, with the rule, its severity, the endpoint and the process that matched. Alerts raised before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• New endpointRuns when an endpoint registers with SentinelOne for the first time, with its name, operating system, addresses, site and group. Endpoints there before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• Endpoint infectedRuns when an endpoint gets its first active threat, with the endpoint and how many threats it has. Once it is clean, it runs again the next time. Endpoints already infected when the workflow is turned on don't start it. How often it checks follows your workspace plan.
• Endpoint went offlineRuns when an endpoint stops checking in with SentinelOne, with when it was last seen. Once it is back online, it runs again the next time. Endpoints offline when the workflow is turned on, or for more than a week, don't start it. How often it checks follows your workspace plan.
• Endpoint isolatedRuns when an endpoint is disconnected from the network, by a person, a workflow or a policy, with the endpoint. Once it is reconnected, it runs again the next time. Endpoints isolated when the workflow is turned on don't start it. How often it checks follows your workspace plan.
• New activityRuns for each new entry in the console's activity log of the kinds you choose, such as a user signing in, a policy changing or a threat being mitigated. Activities before the workflow was turned on don't start it. How often it checks follows your workspace plan.

• List threatsFind threats SentinelOne detected on endpoints, newest first, by site, status, verdict, confidence, time or computer, with the file, hashes, endpoint and what was done about each.
• Get threatGet one threat: its name, classification, statuses, file and hashes, and the endpoint it was found on.
• Mitigate threatsKill, quarantine, remediate, roll back or release threats from quarantine. The agents carry it out and report back in the threat's mitigation actions.
• Update threat statusSet threats' incident status (unresolved, in progress or resolved), and their analyst verdict with it if you choose one.
• Update threat verdictSet threats' analyst verdict: true positive, false positive, suspicious or undefined.
• Set threat ticket IDRecord a ticket number from another system (a service desk or SOAR case) on threats, so the console links them.
• Add threat noteAdd a note to one or more threats, shown on each threat in the console.
• List threat notesList a threat's notes, newest first, with who wrote each.
• Delete threat noteDelete one note from a threat.
• Get threat timelineList what happened to a threat, newest first: detection, mitigation, status changes and notes.
• List alertsFind alerts raised by STAR custom detection rules, newest first, by site, severity, status, verdict, time or rule, with the endpoint and process that matched.
• Update alert statusSet alerts' incident status: unresolved, in progress or resolved.
• Update alert verdictSet alerts' analyst verdict: true positive, false positive, suspicious or undefined.
• List endpointsFind endpoints running the SentinelOne agent by site, group, name, operating system, network state, online or offline, or infection, with each one's addresses, user, agent version and threats.
• Get endpointGet one endpoint by its agent id: name, operating system, addresses, whether it is online or isolated, and its active threats.
• Disconnect endpoints from networkIsolate endpoints from the network so a threat can't spread. They still talk to the SentinelOne console, so you can investigate and reconnect them.
• Reconnect endpoints to networkReconnect isolated endpoints to the network.
• Start full disk scanStart a Full Disk Scan on endpoints, which finds dormant threats and handles them by the endpoint's policy.
• Stop full disk scanStop a Full Disk Scan running on endpoints.
• List sitesList the sites the token can see, with their account, state and license use.
• List groupsList endpoint groups, with their site and how many endpoints each has.
• List activitiesRead the console's activity log, newest first: detections, mitigations, user actions and endpoint events, by type, site, threat, endpoint or time.
• List blocklistList file hashes on the blocklist, newest first, including those set for the whole account and for sites under it.
• Add to blocklistBlock a file from running by its SHA1 or SHA256 hash, everywhere or in chosen sites or accounts.
• Remove from blocklistRemove items from the blocklist by their ids, so the files may run again.

No actions match that.