{"id":"f04dbbbb-6cc2-4fe9-9a05-8a5d9164cce5","task":"Query threats and trigger remediation via the SentinelOne API","domain":"usea1.sentinelone.net","steps":["Generate an API token in the SentinelOne management console under Settings > Users > API Token (Admin role recommended) and include it as Authorization: ApiToken YOUR_TOKEN on all requests; note your console URL (https://{tenant}.sentinelone.net).","Query threats with GET https://{tenant}.sentinelone.net/web/api/v2.1/threats, using query parameters such as resolved (false for open threats), agentMachineTypeIn, severityIn, and createdAt__gte (ISO 8601) to filter the result set.","Parse each threat object for id, agentId, threatInfo.threatName, threatInfo.sha256, threatInfo.confidenceLevel, threatInfo.mitigationStatus, and agentRealtimeInfo.agentComputerName to build incident context.","Trigger automated mitigation on a specific threat by POSTing to https://{tenant}.sentinelone.net/web/api/v2.1/threats/mitigate/{action} (where action is one of: quarantine, kill, remediate, rollback-remediation) with a JSON body containing a filter containing the threat IDs.","Confirm remediation by polling the threat record until mitigationStatus transitions to the expected state; log the outcome alongside the original threat ID for audit trail purposes."],"gotchas":["Tenant console URLs are region-specific (e.g., usea1, euc1) and cannot be inferred; hard-coding the wrong subdomain results in HTTP 404 or connection errors — retrieve the correct URL from the SentinelOne portal.","Remediation actions such as rollback use VSS (Volume Shadow Copy) snapshots and are only available on Windows agents with VSS enabled; calling rollback on an incompatible endpoint returns a success HTTP status but the action silently fails on the agent.","The API uses cursor-based pagination via the nextCursor field; offset-based paging is not supported for the threats endpoint — implement cursor tracking for complete result retrieval."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f04dbbbb-6cc2-4fe9-9a05-8a5d9164cce5"}