{
  "schema": "aaes/capability-pack/1",
  "provider": "sentinelone",
  "version": "1.1.0",
  "description": "SentinelOne Singularity management API (v2.1): read agents, threats and activities, mitigate or resolve threats, and network-isolate or reconnect agents.",
  "notes": "Draft: the console API Hub remains the tenant-specific reference. On 2026-10-29 the public Sentinel-One/ai-siem repository supplied v2.1 operation references for agents, threats, activities, mitigation, disconnect and connect. Its README says SentinelOne maintains it with community support and that it is not a formal SentinelOne product. This is vendor-published reference material, with that support boundary; it does not establish compatibility with every tenant version.\n\nThe old POST /web/api/v2.1/threats/mark-as-resolved registration remains UNVERIFIED. The published Threats reference does not list that route. It lists a separate /threats/incident operation, but the full body schema was not retrieved, so this pack does not substitute or claim that operation is equivalent. Do not enable the resolve capability. The complete Swagger file exceeded the web reader's size limit, leaving nested request/response schemas unverified. The pack remains HELD.\n\nReplace sentinelone-console.invalid with the reviewed customer console host in every endpoint, resource locator and egress allowlist together. Keep ACTION unresolved until a concrete permitted mitigation has been reviewed. The published action enum uses rollback-remediation for rollback. Its prose and enum differ on other selectors; refuse uncertain selectors until the tenant API Hub resolves the difference. This pack does not restrict request bodies or ACTION values by itself.\n\nActivities can identify the user who invoked an action; the reference exposes userIds and userEmails filters. The activities capability and its console resource are classified as pii. Agents remain pii; threat and response registrations remain internal, subject to full response-schema and tenant data review. These are AAES handling judgments. Reads declare read/R0; resolve declares update/R2; isolation and mitigation declare deploy/R3; reconnect declares update+deploy/R3. These tiers are action floors, not provider risk ratings.\n\nThe pack registers no agent uninstall, decommission, remote shell, RemoteOps, scans, policy/exclusion/blocklist changes, account/site/user/role administration or ranger configuration. The prior description grouped decommission with irreversible removal of protection; the published Agent Actions reference instead describes removal from the console and automatic recommission on later agent communication. Both operations stay excluded. Standalone rollback is excluded, but mitigation can still request rollback-remediation unless the deployment restricts ACTION. Other mitigation selectors are not claimed absent from the provider API.\n\nA reviewer must finish the unresolved route, nested schemas and credential lifecycle checks before promotion. Token scope, expiry and revocation checks are pending owner. No owner approval or tenant execution is established by this record.",
  "credential": {
    "secret_ref_id": "secret-ref-sentinelone-api-token",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "Store the complete Authorization header value, ApiToken followed by one space and the console API token, in the customer's secret manager. The vendor-maintained ai-siem Management Console API reference documents that scheme and server-side permissions. An external deployment process must generate, store and rotate the token; this pack injects a stored value and does not manage its lifecycle.\n\nUse a dedicated service user with only the endpoint permissions and account/site scope required by the enabled capabilities. The published references name Endpoints.view, Threats.view, Activity Page.view, Endpoints.disconnectFromNetwork and Endpoints.reconnectToNetwork, plus action-specific threat mitigation permissions. The old resolve route has no verified permission contract. Separate read and response credentials where the deployment requires that separation; this pack supplies only one reference.\n\nThe Service Users reference documents generation of a new service-user API token and revocation of the existing one. The Users reference also documents token revocation. The service-user listing includes apiTokenExpiresAt. These establish documented lifecycle operations and an expiry field, not a universal TTL, mandatory expiry, or immediate revocation timing on every console version. Confirm issuance options, expiry and cut-off behavior in the tenant before enabling. Treat captured material as live until those checks establish otherwise; refuse expired or rejected values.\n\nThe deployment must restrict vault reads to the required reference and keep the resolved header in executor memory only for the call, out of logs, traces, diagnostics and crash reports. These controls and the remaining lifecycle questions are pending owner."
  },
  "capabilities": [
    {
      "capability_id": "sentinelone.agents.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/agents",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "sentinelone-agents",
      "description": "List agents from the collection endpoint: computer names, IPs, OS, agent versions and last-active status, plus the last logged-in user name — which is personal data, so the read is classified as pii (personal data). Registered as the collection read only; single-agent reads (GET /web/api/v2.1/agents/{id}) are not registered.\n\nThe host is a reserved placeholder: substitute the customer's console host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "sentinelone.threats.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/threats",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "sentinelone-threats",
      "description": "List threats from the collection endpoint with filter and pagination query parameters: threat names, file paths, hashes, classifications, mitigation status and the affected agent. Registered as the collection read; per-threat notes and analysis-detail endpoints are not registered.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "sentinelone.activities.read",
      "version": "1.1.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/activities",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "sentinelone-console",
      "description": "List console activity records from the collection endpoint: administrative and response actions taken in the console, which can identify the acting user and are classified as pii. Registered as the collection read.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "sentinelone.threats.mitigate",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/threats/mitigate/ACTION",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "deploy"
      ],
      "resource_id": "sentinelone-threats",
      "description": "Apply a mitigation action to one or more threats (threats selected by the request filter; confirm the nested body schema in the tenant reference). ACTION is a placeholder the deployment binds to a concrete mitigation verb before enabling — kill (terminate the malicious process), quarantine (move the file into managed quarantine), remediate or rollback-remediation. The published reference limits rollback to Windows and remediation to macOS and Windows. These are privileged response actions executed on the endpoint by the agent: quarantine and kill are response-action equivalents of isolation, so the registration declares the deploy verb at the minimum R3 tier under the library convention (compare crowdstrike host containment); rollback-remediation restores prior system state and is destructive — where rollback-remediation is not intended, the deployment must exclude that ACTION binding by policy.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "sentinelone.threats.resolve",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/threats/mark-as-resolved",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "update"
      ],
      "resource_id": "sentinelone-threats",
      "description": "UNVERIFIED: no retrieved first-party operation reference establishes POST /web/api/v2.1/threats/mark-as-resolved or its body, effects and permissions. Do not enable this registration. Its proposed update action at R2 and internal data class remain provisional. The reserved host must remain until the route is verified against the tenant API Hub; the published /threats/incident operation is not registered as a replacement.",
      "requires_review": true
    },
    {
      "capability_id": "sentinelone.agents.isolate",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/agents/actions/disconnect",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "deploy"
      ],
      "resource_id": "sentinelone-agents",
      "description": "Network-isolate (network quarantine) one or more agents (agent ids in the request body): the endpoint's network connectivity is severed except to the management console, which can interrupt live production workloads. Registered with the deploy action at the minimum R3 tier as a response-action equivalent of deploy — isolation takes effect on a live production asset and is not consequence-free even though reconnect exists.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "sentinelone.agents.unisolate",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "sentinelone-console.invalid"
      ],
      "endpoint": "https://sentinelone-console.invalid/web/api/v2.1/agents/actions/connect",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-sentinelone-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "update",
        "deploy"
      ],
      "resource_id": "sentinelone-agents",
      "description": "Reconnect one or more network-isolated agents (agent ids in the request body), restoring normal connectivity. Reconnecting changes live endpoint state and re-exposes the network if the host is still compromised, so it declares update and deploy at the minimum R3 tier as a response-action equivalent of deploy — it is not an ordinary reversible edit, and deploy is one of the designated actions requiring human approval.\n\nOn supported AAES-mediated execution paths, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths.\n\nThe host is a reserved placeholder: substitute before enabling.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "sentinelone-agents",
      "kind": "api",
      "locator": "https://sentinelone-console.invalid/web/api/v2.1/agents",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "sentinelone-threats",
      "kind": "api",
      "locator": "https://sentinelone-console.invalid/web/api/v2.1/threats",
      "data_class": "internal",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "sentinelone-console",
      "kind": "api",
      "locator": "https://sentinelone-console.invalid/web/api/v2.1",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "draft",
    "date": "2026-10-29",
    "sources": [
      "https://www.sentinelone.com/faq/ (retrieved 2026-09-21)",
      "https://github.com/Sentinel-One/ai-siem (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/SKILL.md (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/Agents.md (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/Threats.md (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/Activities.md (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/Agent_Actions.md (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/Users.md (retrieved 2026-10-29)",
      "https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/Service_Users.md (retrieved 2026-10-29)"
    ],
    "reviewer_id": "aaes-eng"
  }
}