> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> Reference for the Tracecat SentinelOne integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Abort scan

Action ID: `tools.sentinel_one.abort_scan`

Abort a running scan on SentinelOne agents.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  ID of the agent/device to abort scan on.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## Disable agent

Action ID: `tools.sentinel_one.disable_agent`

Disable a SentinelOne agent.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="agent_id" type="string" required>
  ID of the agent to disable.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="should_reboot" type="boolean">
  Whether the agent should reboot after disabling.

  Default: `false`.
</ParamField>

## Enable agent

Action ID: `tools.sentinel_one.enable_agent`

Enable a SentinelOne agent.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="agent_id" type="string" required>
  ID of the agent to enable.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="should_reboot" type="boolean">
  Whether the agent should reboot after enabling.

  Default: `false`.
</ParamField>

## Initiate scan

Action ID: `tools.sentinel_one.initiate_scan`

Initiate a scan on SentinelOne agents.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  ID of the agent/device to scan.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## Isolate endpoint

Action ID: `tools.sentinel_one.disconnect_device`

Disconnect a SentinelOne agent from the network.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="endpoint_id" type="string" required>
  ID of the endpoint/agent to disconnect.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## List agent IDs

Action ID: `tools.sentinel_one.list_agent_ids`

Get a simple list of SentinelOne agent IDs.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `1000`.
</ParamField>

## List alerts

Action ID: `tools.sentinel_one.list_alerts`

Query for SentinelOne alerts.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time for the query (exclusive).
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time for the query (inclusive).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of alerts to return.

  Default: `100`.
</ParamField>

<ParamField path="query" type="string | object | null">
  SentinelOne search query.

  Default: `null`.
</ParamField>

## List threats

Action ID: `tools.sentinel_one.list_threats`

Query for SentinelOne threats.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time for the query (exclusive).
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time for the query (inclusive).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of alerts to return.

  Default: `100`.
</ParamField>

<ParamField path="query" type="string | object | null">
  SentinelOne search query.

  Default: `null`.
</ParamField>

## Lookup agents by account ID

Action ID: `tools.sentinel_one.lookup_agent_account_id`

Find all SentinelOne agents in a specific account.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="account_id" type="string" required>
  Account ID to filter agents by.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by email

Action ID: `tools.sentinel_one.lookup_agent_email`

Find all SentinelOne agents associated with a user email address.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="email" type="string" required>
  Email address to search for in agent user fields.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by file hash

Action ID: `tools.sentinel_one.lookup_agent_hash`

Find all SentinelOne agents that have encountered threats with a specific file hash.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="file_hash" type="string" required>
  File hash (MD5, SHA1, SHA256) to search for in agent threats.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by group ID

Action ID: `tools.sentinel_one.lookup_agent_groupid`

Find all SentinelOne agents in a specific group.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  Group ID to filter agents by.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by hostname

Action ID: `tools.sentinel_one.lookup_agent_hostname`

Find all SentinelOne agents by hostname/computer name.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="hostname" type="string" required>
  Hostname/computer name to search for (supports partial matches).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by IP address

Action ID: `tools.sentinel_one.lookup_agent_ip`

Find all SentinelOne agents by IP address (external IP, network interface, or gateway).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="ip_address" type="string" required>
  IP address to search for (supports partial matches).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by MAC address

Action ID: `tools.sentinel_one.lookup_agent_mac_address`

Find all SentinelOne agents by MAC address (network interface physical address or gateway MAC).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="mac_address" type="string" required>
  MAC address to search for (supports partial matches, e.g., "aa:0f" or "41:")
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console base URL (e.g., [https://your-tenant.sentinelone.net](https://your-tenant.sentinelone.net))

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of agents to return (1-1000)

  Default: `100`.
</ParamField>

<ParamField path="search_gateway_mac" type="boolean">
  Whether to also search gateway MAC addresses

  Default: `false`.
</ParamField>

## Lookup agents by machine type

Action ID: `tools.sentinel_one.lookup_agent_machine_type`

Find all SentinelOne agents filtered by machine type (laptop, desktop, server, etc.).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="machine_types" type="array[string]" required>
  Machine types to include (e.g., laptop, desktop, server)
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console base URL (e.g., [https://your-tenant.sentinelone.net](https://your-tenant.sentinelone.net))

  Default: `null`.
</ParamField>

<ParamField path="exclude_machine_types" type="array[string]">
  Machine types to exclude (optional)

  Default: `[]`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of agents to return (1-1000)

  Default: `100`.
</ParamField>

## Lookup agents by operating system

Action ID: `tools.sentinel_one.lookup_agent_os`

Find all SentinelOne agents filtered by operating system type, name, revision, and version information.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="os_types" type="array[string]" required>
  OS types to include (e.g., windows, linux, macos, windows\_legacy)
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console base URL (e.g., [https://your-tenant.sentinelone.net](https://your-tenant.sentinelone.net))

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of agents to return (1-1000)

  Default: `100`.
</ParamField>

<ParamField path="os_name" type="string">
  Free-text filter by OS full name (optional)

  Default: `""`.
</ParamField>

<ParamField path="os_revision" type="string">
  OS revision filter (optional)

  Default: `""`.
</ParamField>

<ParamField path="os_version_contains" type="array[string]">
  Free-text filter by OS full name and version (supports multiple values)

  Default: `[]`.
</ParamField>

## Unisolate endpoint

Action ID: `tools.sentinel_one.connect_to_network`

Connect a SentinelOne agent to the network.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="endpoint_id" type="string" required>
  ID of the endpoint/agent to connect.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>