Security
SentinelOne
AI-powered EDR — threats, agents, network isolation, and automated response actions.
Command it in chat
Ask the Orbit Assistant about your SentinelOne data in plain English — it plans the API calls and answers clearly, not with raw JSON.
Automate it with skills
Put SentinelOne inside autonomous skills and playbooks that run on schedules, webhooks, or events — and chain it with your other tools.
Governed by default
Set action policies and member access, require approvals where needed, and review recorded activity. Supported autonomy modes depend on your plan.
19 built-in actions
Explore fictional results in workspace Simulated mode before connecting credentials. Real actions follow workspace approval policies; validate the actions you need with your own account.
List Threats
list_threats
Get Threat
get_threat
Mitigate Threat
mitigate_threat
Mark Threat as Benign
mark_as_benign
List Agents
list_agents
Get Agent
get_agent
Isolate Agent
isolate_agent
Reconnect Agent
reconnect_agent
Initiate Full Disk Scan
initiate_scan
Abort Disk Scan
abort_scan
Decommission Agent
decommission_agent
List Groups
list_groups
List Sites
list_sites
List Activity Log
list_activities
List Exclusions
list_exclusions
Add Exclusion
add_exclusion
Fetch Agent Logs
fetch_agent_logs
Get System Status
get_system_status
List Policies
list_policies
Explore before you connect
Explore SentinelOne in a workspace with fictional sample data before adding credentials. Workspace simulations may use AI Power; signup may require a beta invite.
Explore in a workspace