S

Mitigate Threat

v1Verified
sentinelone.mitigate_threat
securitycriticalMFA Required

Applies kill, quarantine, or remediate mitigation action to a SentinelOne threat. Requires MFA for production endpoints.

Technical Specs

External Calls

https://management.sentinelone.net/web/api/v2.1/threats/mitigate

Data Classification

critical

MFA Timeout

300 seconds

Enforcement

Rust / fail-closed

Usage in Manifest

Add this snippet to your agent manifest file to enable this tool.

{
  "tools": [
    {
      "name": "sentinelone.mitigate_threat",
      "version": "1"
    }
  ],
  "mfa_required_for": [
    "sentinelone.mitigate_threat"
  ]
}

Used By

3

3 agents currently use this tool

All calls are logged to the tamper evident audit chain

Trust & Security

Ed25519 signed descriptor
Rust enforcement, fail-closed
Every call logged to tamper evident chain
Per-agent MFA configuration

Add to Agent

Use this tool in your agent. Sign in to add it to a new or existing agent.

Via CLI

agentsight tool add \
  --name sentinelone.mitigate_threat \
  --version 1
  --mfa-required