Pre-Release
This feature is actively being developed. Breaking changes should be expected. Synqly Labs is available only in Synqly Mesh.
Please contact us before using this feature.
Labs URL: synqly://labs/sentinelone
- Create an integration for the provider, the same way you would for the real provider.
- Set the provider's URL to the Labs URL at the top of this page.
- Fill in the credential fields. Labs accepts any value, but the credential must be the type the provider asks for, such as an OAuth client ID and secret or an API token.
Then call any operation the provider supports. Your requests run through the same connector that serves a real provider tenant, so the responses have the provider's shape and your code works against the real provider without changes.
Provider: SentinelOne Singularity™ Cloud Native Security
| Operation | On Labs |
|---|---|
query_cloud_resource_inventory | Available |
query_compliance_findings | Not available. Cloud security compliance findings, IOMs, and threats are not available on Labs yet. |
query_ioms | Not available. Cloud security compliance findings, IOMs, and threats are not available on Labs yet. |
query_threats | Not available. Cloud security compliance findings, IOMs, and threats are not available on Labs yet. |
| Filter | Operators | Not on Labs |
|---|---|---|
cloud.account.name | eq, in, ne, not_in, like | |
cloud.account.uid | eq, in, ne, not_in, like | |
cloud.provider | eq, in, ne, not_in | |
cloud.region | eq, in, ne, not_in, like | |
device.modified_time | gt, gte, lt, lte | |
device.modified_time_dt | gt, gte, lt, lte | |
device.name | eq, in, ne, not_in, like | |
device.region | eq, in, ne, not_in, like | |
device.type | eq, in, ne, not_in, like | |
device.uid | eq, in, like | |
time | gt, gte, lt, lte | |
time_dt | gt, gte, lt, lte |
| Sort | Directions | Not on Labs |
|---|---|---|
device.modified_time | asc, desc | |
device.modified_time_dt | asc, desc | |
device.name | asc, desc | |
device.type | asc, desc | |
time | asc, desc | |
time_dt | asc, desc |
Provider: SentinelOne Singularity™ Endpoint
| Operation | On Labs |
|---|---|
create_ioa | Available |
create_iocs | Available |
create_threat_note | Available |
delete_ioa | Available |
delete_iocs | Available |
execute_command | Not available. Running commands and retrieving files are not available on Labs yet. |
get_endpoint | Available |
get_threat_notes | Available |
network_quarantine | Available |
query_alerts | Available |
query_applications | Available |
query_edr_events | Available |
query_endpoints | Available |
query_exclusions | Not available. Exclusions and policies are not available on Labs yet. |
query_ioa | Available |
query_iocs | Available |
query_policies | Not available. Exclusions and policies are not available on Labs yet. |
query_threatevents | Available |
retrieve_file | Not available. Running commands and retrieving files are not available on Labs yet. |
update_alert | Not available. Alert updates are not available on Labs yet. |
| Filter | Operators | Not on Labs |
|---|---|---|
device.org.uid | eq | |
device.os.type | eq | |
device.type | eq | |
finding_info.created_time | gt, gte, lt, lte | |
finding_info.created_time_dt | gt, gte, lt, lte | |
finding_info.first_seen_time | gt, gte, lt, lte | |
finding_info.first_seen_time_dt | gt, gte, lt, lte | |
finding_info.title | eq, like | |
finding_info.uid | eq | |
metadata.product.version | eq, like | |
time | gt, gte, lt, lte |
| Filter | Operators | Not on Labs |
|---|---|---|
product.name | like | |
product.vendor_name | like |
| Sort | Directions | Not on Labs |
|---|---|---|
product.name | asc, desc |
| Filter | Operators | Not on Labs |
|---|---|---|
actor.process.file.path | eq, ne, like, in | |
actor.process.name | eq, ne, like, in | |
device.hostname | eq, ne, like, in | |
device.ip | eq, ne, like, in | |
device.os.name | eq, ne, like, in | |
metadata.labels | eq, ne, in | |
query.hostname | eq, ne, like, in | |
time | gte, lte |
| Filter | Operators | Not on Labs |
|---|---|---|
device.domain | eq, like | |
device.hostname | eq, like | |
device.hw_info.serial_number | like | |
device.instance_uid | eq | |
device.ip | like | |
device.mac | like | |
device.name | eq, like | |
device.os.name | like | |
device.os.type | eq, like | |
device.os.version | like | |
device.type | eq, like | |
device.uid | eq, like |
| Sort | Directions | Not on Labs |
|---|---|---|
time | asc, desc |
| Filter | Operators | Not on Labs |
|---|---|---|
created | gt, gte, lt, lte | |
description | like | |
extensions.batchId | eq | |
extensions.uploadTime | gt, gte, lt, lte | |
id | eq | |
modified | gt, gte, lt, lte | |
name | like | |
pattern | eq |
| Filter | Operators | Not on Labs |
|---|---|---|
actor.process.file.path | like | |
confidence | eq | |
device.hostname | eq, like | |
device.org.uid | eq | |
device.type | eq | |
finding_info.created_time | gt, gte, lt, lte | |
finding_info.modified_time | gt, gte, lt, lte | |
metadata.product.version | eq | |
severity | eq | |
time | gt, gte, lt, lte |