sentinelone-threats

Enumerate threats in the SentinelOne service.

sentinelone-threats [profile=PROFILE] [duration=DURATION] [from=FROM] [to=TO] [order=ORDER]

profile=PROFILE: Connect profile code of SentinelOne
duration=DURATION: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=FROM: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=TO: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
order=ORDER: asc or desc.

Output Fields

Field	Type	Name	Description
_time	Date	Event time	e.g. 2026-05-05 16:02:18+0900
profile	String	Connect profile	SentinelOne connect profile code
threat_id	String	Threat ID	e.g. 1234567890123456789
threat_name	String	Threat name	e.g. Invscenter.sys
classification	String	Classification	e.g. Malware, Trojan, Ransomware
classification_source	String	Classification source	e.g. Cloud, Engine
confidence_level	String	AI confidence level	e.g. malicious, suspicious, na
verdict	String	Analyst verdict	e.g. true_positive, false_positive, suspicious, undefined
verdict_desc	String	Analyst verdict description	e.g. True positive
incident_status	String	Incident status	e.g. unresolved, in_progress, resolved
incident_status_desc	String	Incident status description	e.g. Resolved
mitigation_status	String	Mitigation status	e.g. mitigated, active, blocked, pending
mitigation_status_desc	String	Mitigation status description	e.g. Mitigated
initiated_by	String	Initiated by	e.g. agent_policy, dv_command, full_disk_scan
initiated_by_desc	String	Initiated by description	e.g. Agent Policy
detection_type	String	Detection type	e.g. Static, Dynamic
engines	String	Detection engines	Comma separated list. e.g. Driver Blocking, On-Write Static AI
file_path	String	File path	e.g. \Device\HarddiskVolume3\WINDOWS\System32\drivers\PROCEXP1...
file_extension	String	File extension	e.g. SYS
file_extension_type	String	File extension type	e.g. Executable
file_size	Long	File size	In bytes (size)
file_verification	String	File verification type	e.g. SignedVerified, NotSigned
file_md5	String	File MD5	16진수 32자
file_sha1	String	File SHA1	16진수 40자
file_sha256	String	File SHA256	16진수 64자
originator_process	String	Originating process	e.g. handle64.exe
signer	String	Signer identity	e.g. MICROSOFT WINDOWS HARDWARE COMPATIBILITY
signer_valid	Boolean	Is valid certificate	e.g. false
certificate_id	String	Certificate ID	e.g. BEIJING AOLANDE INFORMATION TECHNOLOGY CO., LTD.
process_user	String	Process user	e.g. DESKTOP-EXAMPLE\demouser
storyline	String	Storyline	e.g. 1234567890ABCDEF
is_fileless	Boolean	Is fileless	e.g. false
auto_resolved	Boolean	Automatically resolved	e.g. false
reboot_required	Boolean	Reboot required	e.g. false
pending_actions	String	Pending actions	e.g. false
external_ticket_id	String	External ticket ID
collection_id	String	Collection ID	e.g. 1234567890123456789
hostname	String	Endpoint name	Agent computer name
agent_id	String	Agent ID	e.g. 1234567890123456789
agent_uuid	String	Agent UUID	e.g. 0123456789abcdef0123456789abcdef
agent_domain	String	Agent domain	e.g. WORKGROUP
machine_type	String	Machine type	e.g. laptop
agent_os_name	String	OS name	e.g. Windows 11 Pro
os_family	String	OS family	e.g. windows
agent_os_rev	String	OS revision	e.g. 26200
is_infected	Boolean	Is infected	e.g. false
is_active	Boolean	Is active	e.g. true
is_decommissioned	Boolean	Is decommissioned	e.g. false
network_status	String	Network status	e.g. connected, disconnected
scan_status	String	Scan status	e.g. finished
scan_started	Date	Scan started time	e.g. 2025-03-11 14:26:48+0900
scan_finished	Date	Scan finished time	e.g. 2025-03-12 14:17:33+0900
realtime_agent_ver	String	Realtime agent version	e.g. 24.1.5.277
realtime_account_id	String	Realtime account ID	e.g. 1234567890123456789
realtime_account_name	String	Realtime account name	e.g. ACME Corp
realtime_site_id	String	Realtime site ID	e.g. 1234567890123456789
realtime_site_name	String	Realtime site name	e.g. ACME-Site
realtime_group_id	String	Realtime group ID	e.g. 1234567890123456789
realtime_group_name	String	Realtime group name	e.g. ACME-Group
realtime_reboot_required	Boolean	Realtime reboot required	e.g. false
account_id	String	Account ID	e.g. 1234567890123456789
account_name	String	Account name	e.g. ACME Corp
site_id	String	Site ID	e.g. 1234567890123456789
site_name	String	Site name	e.g. ACME-Site
group_id	String	Group ID	e.g. 1234567890123456789
group_name	String	Group name	e.g. ACME-Group
agent_ip	IP	Agent IP	e.g. 192.168.30.112
external_ip	IP	External IP	e.g. 85.237.230.62
nt_user	String	Last logged in user	e.g. demouser
nt_domain	String	Agent NT domain	e.g. WORKGROUP
indicators	String	Indicators	List of {category, description, ids, tactics}
mitigation_status_list	String	Mitigation status list	List of mitigation actions and statuses
identified	Date	Identification time	e.g. 2026-05-05 16:02:18+0900
first_seen	Date	First seen time
last_seen	Date	Last seen time
reported	Date	Report time	e.g. 2026-05-05 16:02:18+0900
created	Date	Creation time	e.g. 2026-05-05 16:02:18+0900
updated	Date	Updated time	e.g. 2026-05-05 16:07:37+0900