Connect your own SentinelOne Singularity tenant to manage Agents (isolate/reconnect, scan), Threats (mitigate: kill/quarantine/remediate/rollback), Exclusions, Sites/Groups, and Deep Visibility threat hunting queries.
Every capability exposed by SentinelOne, metered per action and guarded by the two-step safety protocol.
connect_sentinelonewriteConnect your own SentinelOne Singularity tenant (Management Console URL + API Token), verifying the credentials with a real call before saving.
list_connectionsreadList the connected SentinelOne tenants.
disconnect_sentinelonewriteDisconnect a SentinelOne tenant: deletes the saved console URL/API token. Nothing in SentinelOne itself is changed.
list_threatsreadList SentinelOne threats on the connected tenant, optionally filtered to resolved/unresolved only.
get_threatreadRead one SentinelOne threat in full by id.
mitigate_threatwriteApply a mitigation action to a SentinelOne threat: kill, quarantine, remediate, rollback-remediation, or un-quarantine. rollback-remediation is DESTRUCTIVE and irreversible -- it restores the affected filesystem to its state before infection.
list_agentsreadList agents (endpoints) enrolled in the connected SentinelOne tenant.
isolate_agentwriteIsolate a SentinelOne agent from the network (network quarantine). The agent stays protected but loses almost all network access -- confirm the target host before running.
reconnect_agentwriteReconnect a previously isolated SentinelOne agent back to the network.
initiate_scanwriteTrigger an on-demand full disk scan on a SentinelOne agent.
list_exclusionsreadList Exclusions (allowlisted hashes/paths/certificates) configured on the connected SentinelOne tenant.
create_exclusionwriteCreate a new Exclusion (allowlist entry) on the connected SentinelOne tenant -- e.g. a known-good file hash or path.
delete_exclusionwritePermanently delete an Exclusion from the connected SentinelOne tenant. Cannot be undone.
run_deep_visibility_queryreadStart a Deep Visibility query (SentinelOne's fleet-wide threat hunting engine) against the connected tenant's telemetry. Returns a query_id -- fetch results with get_deep_visibility_results once it finishes running.
get_deep_visibility_resultsreadRead the results of a previously started Deep Visibility query by its query_id.
audit_sentinelone_tenantreadBuild one aggregated health report across the connected SentinelOne tenant: active (unresolved) threats, infected agents, and inactive agents.
More extensions in Security ready to enable in one click.
Enable SentinelOne in your Imperal workspace in one click - 10,000 free starter credits included.