Sentinelone MCP Server
MCP server for SentinelOne Core + Deep Visibility APIs
Ask AI about Sentinelone MCP Server
Powered by Claude · Grounded in docs
I know everything about Sentinelone MCP Server. Ask me about installation, configuration, usage, or troubleshooting.
0/500
Reviews
Documentation
SentinelOne MCP Server
A Model Context Protocol server that connects AI assistants to your SentinelOne tenant. Manage threats, investigate endpoints, hunt with Deep Visibility, and triage alerts -- all from natural language.
Zero dependencies. Stdlib-only Go binary. No runtime requirements. Just copy and run.
Quick Start
1. Build
git clone https://github.com/c0tton-fluff/sentinelone-mcp-server.git
cd sentinelone-mcp-server
go build -o sentinelone-mcp-server .
2. Get your API token
S1 Console > Profile (top right) > My Profile > Actions > API token operations > Regenerate API token
3. Configure your MCP client
Add to ~/.mcp.json:
{
"mcpServers": {
"sentinelone": {
"command": "/path/to/sentinelone-mcp-server",
"env": {
"SENTINELONE_API_KEY": "your_api_token_here",
"SENTINELONE_API_BASE": "https://your-tenant.sentinelone.net"
}
}
}
}
4. Go
"List all unmitigated threats"
"Investigate threat 1234567890"
"Show infected agents"
"Hunt for PowerShell processes in the last 24 hours"
"What's the reputation of this SHA256?"
"Create an exclusion for /opt/myapp on Linux"
"What applications are installed on Benedict's laptop?"
Tools (21)
Threats
| Tool | What it does |
|---|---|
s1_list_threats | List threats with classification, status, and endpoint filters |
s1_get_threat | Full threat details -- hashes, file path, storyline |
s1_mitigate_threat | Kill, quarantine, un-quarantine, remediate, or rollback |
s1_investigate_threat | One-call investigation: threat + correlated alerts + timeline |
s1_set_analyst_verdict | Set verdict: true_positive, false_positive, suspicious, undefined |
s1_set_incident_status | Set status (with optional verdict in the same call) |
Agents
| Tool | What it does |
|---|---|
s1_list_agents | List agents with OS, status, infection filters, and count-by grouping |
s1_get_agent | Agent details -- version, site, network info, account ID |
s1_isolate_agent | Network isolate an endpoint (maintains S1 comms) |
s1_reconnect_agent | Remove network isolation |
Alerts
| Tool | What it does |
|---|---|
s1_list_alerts | Query unified alerts via GraphQL with severity, verdict, and status filters |
s1_set_alert_verdict | Bulk set analyst verdict on matching alerts |
s1_set_alert_status | Bulk set incident status (with optional verdict) |
Deep Visibility
| Tool | What it does |
|---|---|
s1_dv_query | Run a threat hunting query with automatic polling |
s1_dv_get_events | Retrieve events from a completed query |
Intelligence
| Tool | What it does |
|---|---|
s1_hash_reputation | Hash verdict + fleet-wide hunt via Deep Visibility |
Exclusions
| Tool | What it does |
|---|---|
s1_list_exclusions | List exclusions (path, hash, certificate, browser, file type) |
s1_create_exclusion | Create an exclusion to suppress false-positive detections |
s1_delete_exclusion | Delete exclusions by ID |
STAR Rules
| Tool | What it does |
|---|---|
s1_create_star_rule | Create a custom detection rule from a Deep Visibility query |
Applications
| Tool | What it does |
|---|---|
s1_list_applications | List installed software on endpoints by name or computer |
Full parameter reference
s1_list_threats
| Parameter | Type | Description |
|---|---|---|
computerName | string | Search by endpoint name (partial match) |
threatName | string | Search by threat name (partial match) |
limit | number | Max results (default 50, max 200) |
mitigationStatuses | string[] | not_mitigated, mitigated, marked_as_benign |
classifications | string[] | Malware, PUA, Suspicious |
s1_get_threat
| Parameter | Type | Description |
|---|---|---|
threatId | string | Required. The threat ID |
s1_mitigate_threat
| Parameter | Type | Description |
|---|---|---|
threatId | string | Required. The threat ID |
action | string | Required. kill, quarantine, un-quarantine, remediate, rollback-remediation |
s1_investigate_threat
| Parameter | Type | Description |
|---|---|---|
threatId | string | Required. The threat ID |
s1_set_analyst_verdict
| Parameter | Type | Description |
|---|---|---|
threatId | string | Required. The threat ID |
verdict | string | Required. true_positive, false_positive, suspicious, undefined |
s1_set_incident_status
| Parameter | Type | Description |
|---|---|---|
threatId | string | Required. The threat ID |
status | string | Required. unresolved, in_progress, resolved |
verdict | string | Optional: set analyst verdict in the same call |
s1_list_agents
| Parameter | Type | Description |
|---|---|---|
computerName | string | Search by computer name (partial match) |
limit | number | Max results (default 50, max 200) |
osTypes | string[] | windows, macos, linux |
isActive | boolean | Filter by active status |
isInfected | boolean | Filter by infected status |
networkStatuses | string[] | connected, disconnected, connecting, disconnecting |
countBy | string | Group counts by: user, os, site, group |
s1_get_agent
| Parameter | Type | Description |
|---|---|---|
agentId | string | Required. The agent ID |
s1_isolate_agent / s1_reconnect_agent
| Parameter | Type | Description |
|---|---|---|
agentId | string | Required. The agent ID |
s1_list_alerts
| Parameter | Type | Description |
|---|---|---|
limit | number | Max results (default 50, max 200) |
severity | string | LOW, MEDIUM, HIGH, CRITICAL |
analystVerdict | string | TRUE_POSITIVE, FALSE_POSITIVE, SUSPICIOUS, UNDEFINED |
incidentStatus | string | NEW, IN_PROGRESS, RESOLVED (aliases: unresolved, open) |
siteIds | string[] | Filter by site IDs |
storylineId | string | Correlate with threat by storyline ID |
s1_set_alert_verdict
| Parameter | Type | Description |
|---|---|---|
verdict | string | Required. TRUE_POSITIVE, FALSE_POSITIVE, SUSPICIOUS, UNDEFINED |
alertIds | string[] | Target specific alert IDs |
query | string | Free-text search (use for username matching) |
ruleName | string[] | Filter by rule name (partial match) |
agentName | string[] | Filter by endpoint name, not username (partial match) |
incidentStatus | string[] | Filter by current status |
siteIds | string[] | Filter by site IDs |
s1_set_alert_status
| Parameter | Type | Description |
|---|---|---|
status | string | Required. UNRESOLVED, IN_PROGRESS, RESOLVED |
verdict | string | Optional: set analyst verdict in the same call |
alertIds | string[] | Target specific alert IDs |
query | string | Free-text search (use for username matching) |
ruleName | string[] | Filter by rule name (partial match) |
agentName | string[] | Filter by endpoint name, not username (partial match) |
incidentStatus | string[] | Filter by current status |
siteIds | string[] | Filter by site IDs |
s1_hash_reputation
| Parameter | Type | Description |
|---|---|---|
hash | string | Required. SHA1 (40 chars) or SHA256 (64 chars) |
s1_dv_query
| Parameter | Type | Description |
|---|---|---|
query | string | Required. Deep Visibility query (S1QL) |
fromDate | string | Required. ISO format start date |
toDate | string | Required. ISO format end date |
siteIds | string[] | Filter by site IDs |
accountIds | string[] | Filter by account IDs |
s1_dv_get_events
| Parameter | Type | Description |
|---|---|---|
queryId | string | Required. Query ID from s1_dv_query |
limit | number | Max results (default 100, max 100) |
s1_list_exclusions
| Parameter | Type | Description |
|---|---|---|
type | string | path, white_hash, certificate, browser, file_type |
value | string | Search by exclusion value (partial match) |
osTypes | string | windows, macos, linux (comma-separated) |
siteIds | string[] | Filter by site IDs |
limit | number | Max results (default 50, max 100) |
s1_create_exclusion
| Parameter | Type | Description |
|---|---|---|
type | string | Required. path, white_hash, certificate, browser, file_type |
value | string | Required. The value to exclude |
osType | string | Required. windows, macos, linux |
siteIds | string[] | Scope to specific sites (use s1_get_agent to find siteId) |
description | string | Reason for the exclusion |
mode | string | suppress, suppress_dynamic_only, disable_in_process_monitor, disable_all_monitors |
pathExclusionType | string | subfolders (default) or file |
s1_delete_exclusion
| Parameter | Type | Description |
|---|---|---|
ids | string[] | Required. Exclusion IDs to delete |
s1_create_star_rule
| Parameter | Type | Description |
|---|---|---|
name | string | Required. Rule name |
s1ql | string | Required. Deep Visibility query that triggers the rule |
severity | string | Required. Low, Medium, High, Critical |
siteIds | string[] | Scope to sites |
accountIds | string[] | Scope to accounts |
tenant | boolean | Tenant-wide scope |
description | string | What the rule detects |
treatAsThreat | string | UNDEFINED (alert only), Suspicious, Malicious |
networkQuarantine | boolean | Auto-isolate endpoint on trigger |
expirationMode | string | Permanent (default) or Temporary |
expiration | string | ISO date (required if Temporary) |
status | string | Active (default), Draft, Disabled |
s1_list_applications
| Parameter | Type | Description |
|---|---|---|
name | string | Filter by app name (partial match) |
agentName | string | Filter by endpoint name (partial match) |
limit | number | Max results (default 50, max 1000) |
At least one of name or agentName is required.
Troubleshooting
| Error | Fix |
|---|---|
| Configuration error | Ensure SENTINELONE_API_KEY and SENTINELONE_API_BASE are set |
| API_BASE must be HTTPS | Use https:// not http:// for your tenant URL |
| HTTP 401 | API token expired or invalid -- regenerate in S1 console |
| HTTP 403 | Token lacks permissions for this endpoint |
| HTTP 429 | Rate limited -- server retries automatically with backoff |
| Request timeout | S1 API took >30s -- narrow your query filters |
| Tools not appearing | Verify binary path in ~/.mcp.json, restart your MCP client |
MCP logs: ~/.cache/claude-cli-nodejs/*/mcp-logs-sentinelone/
License
MIT
