Skip to main content

​
Abort scan

Action ID: tools.sentinel_one.abort_scan Abort a running scan on SentinelOne agents. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
device_id
string
required
ID of the agent/device to abort scan on.
​
base_url
string | null
SentinelOne tenant URL.Default: null.

​
Ask Purple AI

Action ID: tools.sentinel_one.purple_ai Ask SentinelOne Purple AI a natural-language security question. Returns a message or a generated PowerQuery. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
question
string
required
Natural-language question to ask Purple AI.
​
account_id
string | null
Account scope ID.Default: null.
​
base_url
string | null
SentinelOne console URL.Default: null.
​
console_id
string | null
Console (deployment) ID. Defaults to the token’s own scope when omitted.Default: null.
​
end_time
integer | null
End of the displayed time range in epoch milliseconds. Defaults to now.Default: null.
​
site_id
string | null
Site scope ID.Default: null.
​
start_time
integer | null
Start of the displayed time range in epoch milliseconds. Defaults to 24 hours ago.Default: null.
​
tenant_id
string | null
Tenant scope ID.Default: null.
​
timeout_seconds
number
HTTP timeout in seconds for the Purple AI request.Default: 120.
​
version
string | null
Console version string.Default: null.

​
Delete PowerQuery

Action ID: tools.sentinel_one.delete_powerquery Delete or cancel a SentinelOne SDL PowerQuery after polling. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
forward_tag
string
required
X-Dataset-Query-Forward-Tag returned by submit_powerquery response headers.
​
query_id
string
required
SDL query ID returned by submit_powerquery.
​
base_url
string | null
SentinelOne tenant URL. /sdl is appended automatically.Default: null.
​
timeout_seconds
number
HTTP timeout in seconds for the SDL delete request.Default: 60.

​
Disable agent

Action ID: tools.sentinel_one.disable_agent Disable a SentinelOne agent. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
agent_id
string
required
ID of the agent to disable.
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
should_reboot
boolean
Whether the agent should reboot after disabling.Default: false.

​
Enable agent

Action ID: tools.sentinel_one.enable_agent Enable a SentinelOne agent. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
agent_id
string
required
ID of the agent to enable.
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
should_reboot
boolean
Whether the agent should reboot after enabling.Default: false.

​
Get PowerQuery results

Action ID: tools.sentinel_one.get_powerquery_results Poll a SentinelOne SDL PowerQuery for status and incremental results. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
forward_tag
string
required
X-Dataset-Query-Forward-Tag returned by submit_powerquery response headers.
​
query_id
string
required
SDL query ID returned by submit_powerquery.
​
base_url
string | null
SentinelOne tenant URL. /sdl is appended automatically.Default: null.
​
last_step_seen
integer
Last step seen for incremental polling.Default: 0.
​
timeout_seconds
number
HTTP timeout in seconds for the SDL results request.Default: 60.

​
Initiate scan

Action ID: tools.sentinel_one.initiate_scan Initiate a scan on SentinelOne agents. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
device_id
string
required
ID of the agent/device to scan.
​
base_url
string | null
SentinelOne tenant URL.Default: null.

​
Isolate endpoint

Action ID: tools.sentinel_one.disconnect_device Disconnect a SentinelOne agent from the network. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
endpoint_id
string
required
ID of the endpoint/agent to disconnect.
​
base_url
string | null
SentinelOne tenant URL.Default: null.

​
List agent IDs

Action ID: tools.sentinel_one.list_agent_ids Get a simple list of SentinelOne agent IDs. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 1000.

​
List alerts

Action ID: tools.sentinel_one.list_alerts Query for SentinelOne alerts. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
end_time
string
required
End time for the query (exclusive).
​
start_time
string
required
Start time for the query (inclusive).
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
Maximum number of alerts to return.Default: 100.
​
query
string | object | null
SentinelOne search query.Default: null.

​
List inventory

Action ID: tools.sentinel_one.list_inventory List SentinelOne inventory assets with API-native filters. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
filters
object
REST-format filter object, e.g. resourceType, name__contains, id__in, or date-range objects. The limit and skip inputs override matching keys.Default: {}.
​
limit
integer
Maximum number of assets to return.Default: 50.
​
skip
integer
Number of assets to skip for pagination.Default: 0.

​
List threats

Action ID: tools.sentinel_one.list_threats Query for SentinelOne threats. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
end_time
string
required
End time for the query (exclusive).
​
start_time
string
required
Start time for the query (inclusive).
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
Maximum number of alerts to return.Default: 100.
​
query
string | object | null
SentinelOne search query.Default: null.

​
Lookup agents by account ID

Action ID: tools.sentinel_one.lookup_agent_account_id Find all SentinelOne agents in a specific account. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
account_id
string
required
Account ID to filter agents by.
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 100.

​
Lookup agents by email

Action ID: tools.sentinel_one.lookup_agent_email Find all SentinelOne agents associated with a user email address. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
email
string
required
Email address to search for in agent user fields.
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 100.

​
Lookup agents by file hash

Action ID: tools.sentinel_one.lookup_agent_hash Find all SentinelOne agents that have encountered threats with a specific file hash. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
file_hash
string
required
File hash (MD5, SHA1, SHA256) to search for in agent threats.
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 100.

​
Lookup agents by group ID

Action ID: tools.sentinel_one.lookup_agent_groupid Find all SentinelOne agents in a specific group. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
group_id
string
required
Group ID to filter agents by.
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 100.

​
Lookup agents by hostname

Action ID: tools.sentinel_one.lookup_agent_hostname Find all SentinelOne agents by hostname/computer name. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
hostname
string
required
Hostname/computer name to search for (supports partial matches).
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 100.

​
Lookup agents by IP address

Action ID: tools.sentinel_one.lookup_agent_ip Find all SentinelOne agents by IP address (external IP, network interface, or gateway). Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
ip_address
string
required
IP address to search for (supports partial matches).
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
limit
integer
The maximum number of agents to return.Default: 100.

​
Lookup agents by MAC address

Action ID: tools.sentinel_one.lookup_agent_mac_address Find all SentinelOne agents by MAC address (network interface physical address or gateway MAC). Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
mac_address
string
required
MAC address to search for (supports partial matches, e.g., “aa:0f” or “41:”)
​
base_url
string | null
SentinelOne console base URL (e.g., https://your-tenant.sentinelone.net)Default: null.
​
limit
integer
Maximum number of agents to return (1-1000)Default: 100.
​
search_gateway_mac
boolean
Whether to also search gateway MAC addressesDefault: false.

​
Lookup agents by machine type

Action ID: tools.sentinel_one.lookup_agent_machine_type Find all SentinelOne agents filtered by machine type (laptop, desktop, server, etc.). Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
machine_types
array[string]
required
Machine types to include (e.g., laptop, desktop, server)
​
base_url
string | null
SentinelOne console base URL (e.g., https://your-tenant.sentinelone.net)Default: null.
​
exclude_machine_types
array[string]
Machine types to exclude (optional)Default: [].
​
limit
integer
Maximum number of agents to return (1-1000)Default: 100.

​
Lookup agents by operating system

Action ID: tools.sentinel_one.lookup_agent_os Find all SentinelOne agents filtered by operating system type, name, revision, and version information. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
os_types
array[string]
required
OS types to include (e.g., windows, linux, macos, windows_legacy)
​
base_url
string | null
SentinelOne console base URL (e.g., https://your-tenant.sentinelone.net)Default: null.
​
limit
integer
Maximum number of agents to return (1-1000)Default: 100.
​
os_name
string
Free-text filter by OS full name (optional)Default: "".
​
os_revision
string
OS revision filter (optional)Default: "".
​
os_version_contains
array[string]
Free-text filter by OS full name and version (supports multiple values)Default: [].

​
Run GraphQL query

Action ID: tools.sentinel_one.graphql Run an arbitrary GraphQL query against a SentinelOne GraphQL API. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
query
string
required
GraphQL query or mutation string.
​
auth_scheme
string
Authorization scheme. Use ApiToken for the console GraphQL gateway (e.g. Purple AI) or Bearer for data-lake GraphQL services (e.g. Unified Alerts).Default: "ApiToken".
​
base_url
string | null
SentinelOne tenant URL.Default: null.
​
endpoint
string
GraphQL endpoint path appended to base_url.Default: "/web/api/v2.1/graphql".
​
timeout_seconds
number
HTTP timeout in seconds for the GraphQL request.Default: 30.
​
variables
object
Variables to bind to the GraphQL query.Default: {}.

​
Run PowerQuery

Action ID: tools.sentinel_one.powerquery Submit a SentinelOne Singularity Data Lake PowerQuery and poll until results are ready. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
query
string
required
PowerQuery string to execute.
​
account_ids
array[string] | null
Optional SentinelOne account IDs to scope the query.Default: null.
​
base_url
string | null
SentinelOne tenant URL. /sdl is appended automatically.Default: null.
​
end_time
string
End time for the query. Accepts SDL relative time or epoch strings.Default: "0s".
​
frequency
string
PowerQuery frequency hint.Default: "LOW".
​
poll_interval
number
Seconds between poll attempts while the query runs.Default: 5.
​
poll_max_attempts
integer
Maximum number of poll attempts. Set to 0 to poll until timeout.Default: 60.
​
query_origin
string | null
Optional provenance string for SDL.Default: null.
​
query_priority
string
SDL query priority.Default: "LOW".
​
result_type
string
PowerQuery result type.Default: "TABLE".
​
start_time
string
Start time for the query. Accepts SDL relative time or epoch strings.Default: "24h".
​
tenant
boolean | null
Query the tenant scope available to the token. Set to false when using account_ids.Default: null.
​
timeout_seconds
number
HTTP timeout in seconds for each SDL request.Default: 60.

​
Submit PowerQuery

Action ID: tools.sentinel_one.submit_powerquery Submit a SentinelOne Singularity Data Lake PowerQuery for event and telemetry threat hunting. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
query
string
required
PowerQuery string to execute.
​
account_ids
array[string] | null
Optional SentinelOne account IDs to scope the query.Default: null.
​
base_url
string | null
SentinelOne tenant URL. /sdl is appended automatically.Default: null.
​
end_time
string
End time for the query. Accepts SDL relative time or epoch strings.Default: "0s".
​
frequency
string
PowerQuery frequency hint.Default: "LOW".
​
query_origin
string | null
Optional provenance string for SDL.Default: null.
​
query_priority
string
SDL query priority.Default: "LOW".
​
result_type
string
PowerQuery result type.Default: "TABLE".
​
start_time
string
Start time for the query. Accepts SDL relative time or epoch strings.Default: "24h".
​
tenant
boolean | null
Query the tenant scope available to the token. Set to false when using account_ids.Default: null.
​
timeout_seconds
number
HTTP timeout in seconds for the SDL submission request.Default: 60.

​
Unisolate endpoint

Action ID: tools.sentinel_one.connect_to_network Connect a SentinelOne agent to the network. Reference: https://github.com/Sentinel-One/purple-mcp

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
endpoint_id
string
required
ID of the endpoint/agent to connect.
​
base_url
string | null
SentinelOne tenant URL.Default: null.

​
Update alert analyst verdict

Action ID: tools.sentinel_one.update_alert_analyst_verdict Update the analyst verdict for one or more SentinelOne alerts. Reference: https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/alerts.md

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
alert_ids
array[string]
required
IDs of the alerts to update.
​
analyst_verdict
string
required
Analyst verdict to apply to the alerts.
​
base_url
string | null
SentinelOne tenant URL.Default: null.

​
Update alert incident status

Action ID: tools.sentinel_one.update_alert_incident_status Update the incident status for one or more SentinelOne alerts. Reference: https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/alerts.md

​
Secrets

Required secrets:
  • sentinel_one: required values SENTINEL_ONE_API_TOKEN.

​
Input fields

​
alert_ids
array[string]
required
IDs of the alerts to update.
​
incident_status
string
required
Incident status to apply to the alerts.
​
base_url
string | null
SentinelOne tenant URL.Default: null.