---
title: "SentinelOne"
description: "Reference for the Tracecat SentinelOne integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Abort scan

Action ID: `tools.sentinel_one.abort_scan`

Abort a running scan on SentinelOne agents.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>

ID of the agent/device to abort scan on.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

## Disable agent

Action ID: `tools.sentinel_one.disable_agent`

Disable a SentinelOne agent.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="agent_id" type="string" required>

ID of the agent to disable.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="should_reboot" type="boolean">

Whether the agent should reboot after disabling.

Default: `false`.

</ParamField>

## Enable agent

Action ID: `tools.sentinel_one.enable_agent`

Enable a SentinelOne agent.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="agent_id" type="string" required>

ID of the agent to enable.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="should_reboot" type="boolean">

Whether the agent should reboot after enabling.

Default: `false`.

</ParamField>

## Initiate scan

Action ID: `tools.sentinel_one.initiate_scan`

Initiate a scan on SentinelOne agents.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>

ID of the agent/device to scan.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

## Isolate endpoint

Action ID: `tools.sentinel_one.disconnect_device`

Disconnect a SentinelOne agent from the network.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="endpoint_id" type="string" required>

ID of the endpoint/agent to disconnect.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

## List agent IDs

Action ID: `tools.sentinel_one.list_agent_ids`

Get a simple list of SentinelOne agent IDs.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `1000`.

</ParamField>

## List alerts

Action ID: `tools.sentinel_one.list_alerts`

Query for SentinelOne alerts.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>

End time for the query (exclusive).

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the query (inclusive).

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of alerts to return.

Default: `100`.

</ParamField>

<ParamField path="query" type="string | object | null">

SentinelOne search query.

Default: `null`.

</ParamField>

## List threats

Action ID: `tools.sentinel_one.list_threats`

Query for SentinelOne threats.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>

End time for the query (exclusive).

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the query (inclusive).

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of alerts to return.

Default: `100`.

</ParamField>

<ParamField path="query" type="string | object | null">

SentinelOne search query.

Default: `null`.

</ParamField>

## Lookup agents by account ID

Action ID: `tools.sentinel_one.lookup_agent_account_id`

Find all SentinelOne agents in a specific account.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="account_id" type="string" required>

Account ID to filter agents by.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `100`.

</ParamField>

## Lookup agents by email

Action ID: `tools.sentinel_one.lookup_agent_email`

Find all SentinelOne agents associated with a user email address.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="email" type="string" required>

Email address to search for in agent user fields.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `100`.

</ParamField>

## Lookup agents by file hash

Action ID: `tools.sentinel_one.lookup_agent_hash`

Find all SentinelOne agents that have encountered threats with a specific file hash.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="file_hash" type="string" required>

File hash (MD5, SHA1, SHA256) to search for in agent threats.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `100`.

</ParamField>

## Lookup agents by group ID

Action ID: `tools.sentinel_one.lookup_agent_groupid`

Find all SentinelOne agents in a specific group.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>

Group ID to filter agents by.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `100`.

</ParamField>

## Lookup agents by hostname

Action ID: `tools.sentinel_one.lookup_agent_hostname`

Find all SentinelOne agents by hostname/computer name.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="hostname" type="string" required>

Hostname/computer name to search for (supports partial matches).

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `100`.

</ParamField>

## Lookup agents by IP address

Action ID: `tools.sentinel_one.lookup_agent_ip`

Find all SentinelOne agents by IP address (external IP, network interface, or gateway).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="ip_address" type="string" required>

IP address to search for (supports partial matches).

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

The maximum number of agents to return.

Default: `100`.

</ParamField>

## Lookup agents by MAC address

Action ID: `tools.sentinel_one.lookup_agent_mac_address`

Find all SentinelOne agents by MAC address (network interface physical address or gateway MAC).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="mac_address" type="string" required>

MAC address to search for (supports partial matches, e.g., "aa:0f" or "41:")

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne console base URL (e.g., https://your-tenant.sentinelone.net)

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of agents to return (1-1000)

Default: `100`.

</ParamField>

<ParamField path="search_gateway_mac" type="boolean">

Whether to also search gateway MAC addresses

Default: `false`.

</ParamField>

## Lookup agents by machine type

Action ID: `tools.sentinel_one.lookup_agent_machine_type`

Find all SentinelOne agents filtered by machine type (laptop, desktop, server, etc.).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="machine_types" type="array[string]" required>

Machine types to include (e.g., laptop, desktop, server)

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne console base URL (e.g., https://your-tenant.sentinelone.net)

Default: `null`.

</ParamField>

<ParamField path="exclude_machine_types" type="array[string]">

Machine types to exclude (optional)

Default: `[]`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of agents to return (1-1000)

Default: `100`.

</ParamField>

## Lookup agents by operating system

Action ID: `tools.sentinel_one.lookup_agent_os`

Find all SentinelOne agents filtered by operating system type, name, revision, and version information.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="os_types" type="array[string]" required>

OS types to include (e.g., windows, linux, macos, windows_legacy)

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne console base URL (e.g., https://your-tenant.sentinelone.net)

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of agents to return (1-1000)

Default: `100`.

</ParamField>

<ParamField path="os_name" type="string">

Free-text filter by OS full name (optional)

Default: `""`.

</ParamField>

<ParamField path="os_revision" type="string">

OS revision filter (optional)

Default: `""`.

</ParamField>

<ParamField path="os_version_contains" type="array[string]">

Free-text filter by OS full name and version (supports multiple values)

Default: `[]`.

</ParamField>

## Unisolate endpoint

Action ID: `tools.sentinel_one.connect_to_network`

Connect a SentinelOne agent to the network.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

- `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="endpoint_id" type="string" required>

ID of the endpoint/agent to connect.

</ParamField>

<ParamField path="base_url" type="string | null">

SentinelOne tenant URL.

Default: `null`.

</ParamField>
