Get Threat Timeline

Get a threat's timeline.

Parameters

Parameter	Description
Cursor	Cursor position returned by the last request. Use to iterate over more than 1000 items. Example: "YWdlbnRfaWQ6NTgwMjkzODE=".
Limit	Limit number of returned items (1-1000). Example: 10.
Return All Pages	Automatically fetch all resources, page by page.
Sort By	The column to sort the results by.
Threat ID	The threat ID.

Example Output

{
    "errors": [
        {
            "type": "object"
        }
    ],
    "pagination": {
        "nextCursor": "YWdlbnRfaWQ6NTgwMjkzODE=",
        "totalItems": 580
    },
    "data": [
        {
            "siteId": "225494730938493804",
            "secondaryDescription": "string",
            "id": "225494730938493804",
            "hash": "string",
            "userId": "225494730938493804",
            "agentId": "225494730938493804",
            "createdAt": "2018-02-27T04:49:26.257525Z",
            "data": {
                "computer_name": "COMP_1234",
                "username": "my_user"
            },
            "osFamily": "macos",
            "accountId": "225494730938493804",
            "groupId": "225494730938493804",
            "primaryDescription": "string",
            "updatedAt": "2018-02-27T04:49:26.257525Z",
            "threatId": "225494730938493804",
            "agentUpdatedVersion": "2.5.1.1320",
            "activityType": "integer"
        }
    ]
}

Workflow Library Example

Get Threat Timeline with Sentinelone and Send Results Via Email

Preview this Workflow on desktop