feat(integration): SentinelOne list Threats + update Threat status

registry/tracecat_registry/templates/sentinel_one/list_threats.yml

@@ -0,0 +1,33 @@
+type: action
+definition:
+  title: List SentinelOne Threats
+  description: List threats from SentinelOne
+  display_group: SentinelOne
+  namespace: integrations.sentinel_one
+  name: list_threats
+  secrets:
+    - name: sentinel_one
+      keys: ["SENTINEL_ONE_API_TOKEN", "SENTINEL_ONE_BASE_URL"]
+  expects:
+    start_time:
+      type: datetime
+      description: Start timestamp for the query (inclusive)
+    end_time:
+      type: datetime
+      description: End timestamp for the query (inclusive)
+    limit:
+      type: int
+      description: Maximum number of alerts to return
+  steps:
+    - ref: query_threats
+      action: core.http_request
+      args:
+        url: ${{ SECRETS.sentinel_one.SENTINEL_ONE_BASE_URL }}/web/api/v2.1/threats
+        method: GET
+        headers:
+          Authorization: "ApiToken ${{ SECRETS.sentinel_one.SENTINEL_ONE_API_TOKEN }}"
+        params:
+          created_at__gte: ${{ inputs.start_time }}
+          created_at__lte: ${{ inputs.end_time }}
+          limit: ${{ inputs.limit }}
+  returns: ${{ steps.query_threats.result }}

registry/tracecat_registry/templates/sentinel_one/update_threat_status.yml

@@ -0,0 +1,35 @@
+type: action
+definition:
+  title: Update SentinelOne Threat Status
+  description: Update the status of a SentinelOne threat
+  display_group: SentinelOne
+  namespace: integrations.sentinel_one
+  name: update_threat_status
+  secrets:
+    - name: sentinel_one
+      keys: ["SENTINEL_ONE_API_TOKEN", "SENTINEL_ONE_BASE_URL"]
+  expects:
+    threat_ids:
+      type: list[str]
+      description: The IDs of the threats to update
+    verdict:
+      type: str
+      description: The new status of the threat
+    status:
+      type: str
+      description: The analyst verdict of the threat
+  steps:
+    - ref: update_threat_status
+      action: core.http_request
+      args:
+        url: ${{ SECRETS.sentinel_one.SENTINEL_ONE_BASE_URL }}/web/api/v2.1/threats/incident
+        method: POST
+        headers:
+          Authorization: ApiToken ${{ SECRETS.sentinel_one.SENTINEL_ONE_API_TOKEN }}
+        payload:
+          data:
+            incidentStatus: ${{ inputs.status }}
+            analystVerdict: ${{ inputs.verdict }}
+          filter:
+            ids: ${{ inputs.threat_ids }}
+  returns: ${{ steps.update_threat_status.result }}