> ## Documentation Index
> Fetch the complete documentation index at: https://tracecat-feat-mcp-cred-setup.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

> Reference for the Tracecat SentinelOne integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Abort scan

Action ID: `tools.sentinel_one.abort_scan`

Abort a running scan on SentinelOne agents.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  ID of the agent/device to abort scan on.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## Ask Purple AI

Action ID: `tools.sentinel_one.purple_ai`

Ask SentinelOne Purple AI a natural-language security question. Returns a message or a generated PowerQuery.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="question" type="string" required>
  Natural-language question to ask Purple AI.
</ParamField>

<ParamField path="account_id" type="string | null">
  Account scope ID.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console URL.

  Default: `null`.
</ParamField>

<ParamField path="console_id" type="string | null">
  Console (deployment) ID. Defaults to the token's own scope when omitted.

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="integer | null">
  End of the displayed time range in epoch milliseconds. Defaults to now.

  Default: `null`.
</ParamField>

<ParamField path="site_id" type="string | null">
  Site scope ID.

  Default: `null`.
</ParamField>

<ParamField path="start_time" type="integer | null">
  Start of the displayed time range in epoch milliseconds. Defaults to 24 hours ago.

  Default: `null`.
</ParamField>

<ParamField path="tenant_id" type="string | null">
  Tenant scope ID.

  Default: `null`.
</ParamField>

<ParamField path="timeout_seconds" type="number">
  HTTP timeout in seconds for the Purple AI request.

  Default: `120`.
</ParamField>

<ParamField path="version" type="string | null">
  Console version string.

  Default: `null`.
</ParamField>

## Delete PowerQuery

Action ID: `tools.sentinel_one.delete_powerquery`

Delete or cancel a SentinelOne SDL PowerQuery after polling.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="forward_tag" type="string" required>
  X-Dataset-Query-Forward-Tag returned by submit\_powerquery response headers.
</ParamField>

<ParamField path="query_id" type="string" required>
  SDL query ID returned by submit\_powerquery.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL. /sdl is appended automatically.

  Default: `null`.
</ParamField>

<ParamField path="timeout_seconds" type="number">
  HTTP timeout in seconds for the SDL delete request.

  Default: `60`.
</ParamField>

## Disable agent

Action ID: `tools.sentinel_one.disable_agent`

Disable a SentinelOne agent.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="agent_id" type="string" required>
  ID of the agent to disable.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="should_reboot" type="boolean">
  Whether the agent should reboot after disabling.

  Default: `false`.
</ParamField>

## Enable agent

Action ID: `tools.sentinel_one.enable_agent`

Enable a SentinelOne agent.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="agent_id" type="string" required>
  ID of the agent to enable.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="should_reboot" type="boolean">
  Whether the agent should reboot after enabling.

  Default: `false`.
</ParamField>

## Get PowerQuery results

Action ID: `tools.sentinel_one.get_powerquery_results`

Poll a SentinelOne SDL PowerQuery for status and incremental results.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="forward_tag" type="string" required>
  X-Dataset-Query-Forward-Tag returned by submit\_powerquery response headers.
</ParamField>

<ParamField path="query_id" type="string" required>
  SDL query ID returned by submit\_powerquery.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL. /sdl is appended automatically.

  Default: `null`.
</ParamField>

<ParamField path="last_step_seen" type="integer">
  Last step seen for incremental polling.

  Default: `0`.
</ParamField>

<ParamField path="timeout_seconds" type="number">
  HTTP timeout in seconds for the SDL results request.

  Default: `60`.
</ParamField>

## Initiate scan

Action ID: `tools.sentinel_one.initiate_scan`

Initiate a scan on SentinelOne agents.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  ID of the agent/device to scan.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## Isolate endpoint

Action ID: `tools.sentinel_one.disconnect_device`

Disconnect a SentinelOne agent from the network.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="endpoint_id" type="string" required>
  ID of the endpoint/agent to disconnect.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## List agent IDs

Action ID: `tools.sentinel_one.list_agent_ids`

Get a simple list of SentinelOne agent IDs.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `1000`.
</ParamField>

## List alerts

Action ID: `tools.sentinel_one.list_alerts`

Query for SentinelOne alerts.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time for the query (exclusive).
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time for the query (inclusive).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of alerts to return.

  Default: `100`.
</ParamField>

<ParamField path="query" type="string | object | null">
  SentinelOne search query.

  Default: `null`.
</ParamField>

## List inventory

Action ID: `tools.sentinel_one.list_inventory`

List SentinelOne inventory assets with API-native filters.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="filters" type="object">
  REST-format filter object, e.g. resourceType, name\_\_contains, id\_\_in, or date-range objects. The limit and skip inputs override matching keys.

  Default: `{}`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of assets to return.

  Default: `50`.
</ParamField>

<ParamField path="skip" type="integer">
  Number of assets to skip for pagination.

  Default: `0`.
</ParamField>

## List threats

Action ID: `tools.sentinel_one.list_threats`

Query for SentinelOne threats.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time for the query (exclusive).
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time for the query (inclusive).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of alerts to return.

  Default: `100`.
</ParamField>

<ParamField path="query" type="string | object | null">
  SentinelOne search query.

  Default: `null`.
</ParamField>

## Lookup agents by account ID

Action ID: `tools.sentinel_one.lookup_agent_account_id`

Find all SentinelOne agents in a specific account.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="account_id" type="string" required>
  Account ID to filter agents by.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by email

Action ID: `tools.sentinel_one.lookup_agent_email`

Find all SentinelOne agents associated with a user email address.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="email" type="string" required>
  Email address to search for in agent user fields.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by file hash

Action ID: `tools.sentinel_one.lookup_agent_hash`

Find all SentinelOne agents that have encountered threats with a specific file hash.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="file_hash" type="string" required>
  File hash (MD5, SHA1, SHA256) to search for in agent threats.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by group ID

Action ID: `tools.sentinel_one.lookup_agent_groupid`

Find all SentinelOne agents in a specific group.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="group_id" type="string" required>
  Group ID to filter agents by.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by hostname

Action ID: `tools.sentinel_one.lookup_agent_hostname`

Find all SentinelOne agents by hostname/computer name.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="hostname" type="string" required>
  Hostname/computer name to search for (supports partial matches).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by IP address

Action ID: `tools.sentinel_one.lookup_agent_ip`

Find all SentinelOne agents by IP address (external IP, network interface, or gateway).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="ip_address" type="string" required>
  IP address to search for (supports partial matches).
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  The maximum number of agents to return.

  Default: `100`.
</ParamField>

## Lookup agents by MAC address

Action ID: `tools.sentinel_one.lookup_agent_mac_address`

Find all SentinelOne agents by MAC address (network interface physical address or gateway MAC).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="mac_address" type="string" required>
  MAC address to search for (supports partial matches, e.g., "aa:0f" or "41:")
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console base URL (e.g., [https://your-tenant.sentinelone.net](https://your-tenant.sentinelone.net))

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of agents to return (1-1000)

  Default: `100`.
</ParamField>

<ParamField path="search_gateway_mac" type="boolean">
  Whether to also search gateway MAC addresses

  Default: `false`.
</ParamField>

## Lookup agents by machine type

Action ID: `tools.sentinel_one.lookup_agent_machine_type`

Find all SentinelOne agents filtered by machine type (laptop, desktop, server, etc.).

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="machine_types" type="array[string]" required>
  Machine types to include (e.g., laptop, desktop, server)
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console base URL (e.g., [https://your-tenant.sentinelone.net](https://your-tenant.sentinelone.net))

  Default: `null`.
</ParamField>

<ParamField path="exclude_machine_types" type="array[string]">
  Machine types to exclude (optional)

  Default: `[]`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of agents to return (1-1000)

  Default: `100`.
</ParamField>

## Lookup agents by operating system

Action ID: `tools.sentinel_one.lookup_agent_os`

Find all SentinelOne agents filtered by operating system type, name, revision, and version information.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="os_types" type="array[string]" required>
  OS types to include (e.g., windows, linux, macos, windows\_legacy)
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne console base URL (e.g., [https://your-tenant.sentinelone.net](https://your-tenant.sentinelone.net))

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of agents to return (1-1000)

  Default: `100`.
</ParamField>

<ParamField path="os_name" type="string">
  Free-text filter by OS full name (optional)

  Default: `""`.
</ParamField>

<ParamField path="os_revision" type="string">
  OS revision filter (optional)

  Default: `""`.
</ParamField>

<ParamField path="os_version_contains" type="array[string]">
  Free-text filter by OS full name and version (supports multiple values)

  Default: `[]`.
</ParamField>

## Run GraphQL query

Action ID: `tools.sentinel_one.graphql`

Run an arbitrary GraphQL query against a SentinelOne GraphQL API.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="query" type="string" required>
  GraphQL query or mutation string.
</ParamField>

<ParamField path="auth_scheme" type="string">
  Authorization scheme. Use ApiToken for the console GraphQL gateway (e.g. Purple AI) or Bearer for data-lake GraphQL services (e.g. Unified Alerts).

  Default: `"ApiToken"`.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

<ParamField path="endpoint" type="string">
  GraphQL endpoint path appended to base\_url.

  Default: `"/web/api/v2.1/graphql"`.
</ParamField>

<ParamField path="timeout_seconds" type="number">
  HTTP timeout in seconds for the GraphQL request.

  Default: `30`.
</ParamField>

<ParamField path="variables" type="object">
  Variables to bind to the GraphQL query.

  Default: `{}`.
</ParamField>

## Run PowerQuery

Action ID: `tools.sentinel_one.powerquery`

Submit a SentinelOne Singularity Data Lake PowerQuery and poll until results are ready.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="query" type="string" required>
  PowerQuery string to execute.
</ParamField>

<ParamField path="account_ids" type="array[string] | null">
  Optional SentinelOne account IDs to scope the query.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL. /sdl is appended automatically.

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="string">
  End time for the query. Accepts SDL relative time or epoch strings.

  Default: `"0s"`.
</ParamField>

<ParamField path="frequency" type="string">
  PowerQuery frequency hint.

  Default: `"LOW"`.
</ParamField>

<ParamField path="poll_interval" type="number">
  Seconds between poll attempts while the query runs.

  Default: `5`.
</ParamField>

<ParamField path="poll_max_attempts" type="integer">
  Maximum number of poll attempts. Set to 0 to poll until timeout.

  Default: `60`.
</ParamField>

<ParamField path="query_origin" type="string | null">
  Optional provenance string for SDL.

  Default: `null`.
</ParamField>

<ParamField path="query_priority" type="string">
  SDL query priority.

  Default: `"LOW"`.
</ParamField>

<ParamField path="result_type" type="string">
  PowerQuery result type.

  Default: `"TABLE"`.
</ParamField>

<ParamField path="start_time" type="string">
  Start time for the query. Accepts SDL relative time or epoch strings.

  Default: `"24h"`.
</ParamField>

<ParamField path="tenant" type="boolean | null">
  Query the tenant scope available to the token. Set to false when using account\_ids.

  Default: `null`.
</ParamField>

<ParamField path="timeout_seconds" type="number">
  HTTP timeout in seconds for each SDL request.

  Default: `60`.
</ParamField>

## Submit PowerQuery

Action ID: `tools.sentinel_one.submit_powerquery`

Submit a SentinelOne Singularity Data Lake PowerQuery for event and telemetry threat hunting.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="query" type="string" required>
  PowerQuery string to execute.
</ParamField>

<ParamField path="account_ids" type="array[string] | null">
  Optional SentinelOne account IDs to scope the query.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL. /sdl is appended automatically.

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="string">
  End time for the query. Accepts SDL relative time or epoch strings.

  Default: `"0s"`.
</ParamField>

<ParamField path="frequency" type="string">
  PowerQuery frequency hint.

  Default: `"LOW"`.
</ParamField>

<ParamField path="query_origin" type="string | null">
  Optional provenance string for SDL.

  Default: `null`.
</ParamField>

<ParamField path="query_priority" type="string">
  SDL query priority.

  Default: `"LOW"`.
</ParamField>

<ParamField path="result_type" type="string">
  PowerQuery result type.

  Default: `"TABLE"`.
</ParamField>

<ParamField path="start_time" type="string">
  Start time for the query. Accepts SDL relative time or epoch strings.

  Default: `"24h"`.
</ParamField>

<ParamField path="tenant" type="boolean | null">
  Query the tenant scope available to the token. Set to false when using account\_ids.

  Default: `null`.
</ParamField>

<ParamField path="timeout_seconds" type="number">
  HTTP timeout in seconds for the SDL submission request.

  Default: `60`.
</ParamField>

## Unisolate endpoint

Action ID: `tools.sentinel_one.connect_to_network`

Connect a SentinelOne agent to the network.

Reference: [https://github.com/Sentinel-One/purple-mcp](https://github.com/Sentinel-One/purple-mcp)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="endpoint_id" type="string" required>
  ID of the endpoint/agent to connect.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## Update alert analyst verdict

Action ID: `tools.sentinel_one.update_alert_analyst_verdict`

Update the analyst verdict for one or more SentinelOne alerts.

Reference: [https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/alerts.md](https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/alerts.md)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  IDs of the alerts to update.
</ParamField>

<ParamField path="analyst_verdict" type="string" required>
  Analyst verdict to apply to the alerts.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>

## Update alert incident status

Action ID: `tools.sentinel_one.update_alert_incident_status`

Update the incident status for one or more SentinelOne alerts.

Reference: [https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/alerts.md](https://github.com/Sentinel-One/ai-siem/blob/main/plugins/s1-secops-skills/skills/mgmt-console-api/references/tags/alerts.md)

### Secrets

Required secrets:

* `sentinel_one`: required values `SENTINEL_ONE_API_TOKEN`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  IDs of the alerts to update.
</ParamField>

<ParamField path="incident_status" type="string" required>
  Incident status to apply to the alerts.
</ParamField>

<ParamField path="base_url" type="string | null">
  SentinelOne tenant URL.

  Default: `null`.
</ParamField>