From sentinelone
Triages new SentinelOne alerts, investigates specifics, searches by severity/status with GraphQL filters, reviews timelines, and manages MSP workflows using read-only tools.
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin sentineloneThis skill uses the workspace's default tool permissions.
Alerts in SentinelOne represent detected threats, suspicious behaviors, policy violations, and security events across the Singularity platform. The unified alert system aggregates detections from endpoints, cloud workloads, Kubernetes, identity providers, infrastructure-as-code scanning, and offensive security testing into a single view. For MSPs, alerts are the primary triage surface -- every ...
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
Calculates TAM/SAM/SOM using top-down, bottom-up, and value theory methodologies for market sizing, revenue estimation, and startup validation.
Alerts in SentinelOne represent detected threats, suspicious behaviors, policy violations, and security events across the Singularity platform. The unified alert system aggregates detections from endpoints, cloud workloads, Kubernetes, identity providers, infrastructure-as-code scanning, and offensive security testing into a single view. For MSPs, alerts are the primary triage surface -- every investigation starts with understanding what was detected, its severity, and which client environment is affected.
All alert tools are read-only. You can view, search, and investigate alerts, but you cannot modify alert status, assignments, or take response actions through the MCP tools.
| Tool | Description | Key Parameters |
|---|---|---|
get_alert | Get a single alert by ID | alertId (required) |
list_alerts | List alerts with filters | severity, status, viewType, limit, cursor, sortBy, sortOrder |
search_alerts | Search alerts with GraphQL filters | filters (array of fieldId/filterType/values), limit, cursor |
get_alert_notes | Get notes/comments on an alert | alertId (required) |
get_alert_history | Get timeline of changes for an alert | alertId (required) |
Call list_alerts with optional parameters:
severity to CRITICAL, HIGH, MEDIUM, LOW, INFO, or UNKNOWNstatus to NEW, IN_PROGRESS, RESOLVED, or FALSE_POSITIVEviewType to scope the alert domain (see View Types below)sortBy (e.g., severity, detectedAt) and sortOrder (ASC or DESC)limit and use cursor from the response for subsequent pagesExample: List all new critical alerts:
list_alerts with severity=CRITICAL, status=NEW, sortBy=detectedAt, sortOrder=DESCExample: List all cloud alerts:
list_alerts with viewType=CLOUD, limit=50Call search_alerts with a filters array for complex queries:
Example: Search for alerts on a specific endpoint:
search_alerts with filters=[{"fieldId": "endpointName", "filterType": "CONTAINS", "values": ["workstation-01"]}]Example: Search for alerts with a specific threat name:
search_alerts with filters=[{"fieldId": "name", "filterType": "CONTAINS", "values": ["ransomware"]}]Call get_alert with the alertId to retrieve full details including threat context, affected assets, and detection metadata.
Call get_alert_notes with the alertId to retrieve analyst comments and investigation notes attached to the alert.
Call get_alert_history with the alertId to retrieve the full timeline of status changes, assignments, and updates.
| Severity | Description | MSP Action |
|---|---|---|
CRITICAL | Active, confirmed threat requiring immediate response | Immediate escalation; notify client |
HIGH | High-confidence detection likely requiring investigation | Investigate within 1 hour |
MEDIUM | Moderate-confidence detection or policy violation | Investigate within 4 hours |
LOW | Low-confidence detection or informational security event | Review during next triage cycle |
INFO | Informational event, no immediate action needed | Log for trending and reporting |
UNKNOWN | Severity not yet classified | Review and classify |
| Status | Description |
|---|---|
NEW | Alert has been created and not yet reviewed |
IN_PROGRESS | Alert is being investigated by an analyst |
RESOLVED | Alert has been investigated and closed |
FALSE_POSITIVE | Alert was a false detection |
View types scope alerts to specific detection domains:
| View Type | Description |
|---|---|
ALL | All alert types (default) |
CLOUD | Cloud infrastructure alerts (AWS, Azure, GCP) |
KUBERNETES | Kubernetes cluster and workload alerts |
IDENTITY | Identity-based alerts (Active Directory, Entra ID) |
INFRASTRUCTURE_AS_CODE | IaC scanning alerts (Terraform, CloudFormation) |
ADMISSION_CONTROLLER | Kubernetes admission controller alerts |
OFFENSIVE_SECURITY | Penetration testing and red team alerts |
SECRET_SCANNING | Exposed secrets and credential alerts |
Search tools use GraphQL filters with the following structure:
{
"fieldId": "severity",
"filterType": "EQUALS",
"values": ["CRITICAL"]
}
Filter Types:
| Filter Type | Description |
|---|---|
EQUALS | Exact match on a single value |
NOT_EQUALS | Exclude exact match |
CONTAINS | Substring match |
IN | Match any value in the list |
NOT_IN | Exclude any value in the list |
Negation:
Add "isNegated": true to any filter to invert it:
{
"fieldId": "status",
"filterType": "EQUALS",
"values": ["RESOLVED"],
"isNegated": true
}
Alert list and search tools use cursor-based pagination:
limit (e.g., 50)cursor valuecursor to the next call to fetch the next page| Field | Type | Description |
|---|---|---|
alertId | string | Unique alert identifier |
name | string | Alert/detection name |
severity | string | CRITICAL/HIGH/MEDIUM/LOW/INFO/UNKNOWN |
status | string | NEW/IN_PROGRESS/RESOLVED/FALSE_POSITIVE |
detectedAt | datetime | When the alert was first detected |
viewType | string | Detection domain (CLOUD, KUBERNETES, etc.) |
endpointName | string | Affected endpoint hostname |
siteName | string | SentinelOne site (typically maps to MSP client) |
accountName | string | SentinelOne account |
description | string | Alert description with threat context |
mitreAttackTechniques | array | MITRE ATT&CK technique IDs |
indicators | array | Indicators of compromise (IOCs) |
affectedAssets | array | Assets involved in the detection |
The most critical MSP workflow -- reviewing new alerts by severity:
list_alerts with status=NEW, sortBy=severity, sortOrder=DESC, limit=50get_alert with the alertId for full detailsget_alert_notes and get_alert_history for contextget_alert with the alertId to get full detailsget_alert_notes to see any existing investigation notesget_alert_history to see the timeline of changespurple_ai to investigate the threat described in the alertlist_inventory_items to understand the affected assetsearch_alerts with filters=[{"fieldId": "severity", "filterType": "IN", "values": ["CRITICAL", "HIGH"]}]siteName (client) to see which clients have the most critical alertsget_alert with the alertIdget_alert_history to see all status changes and assignmentslist_alerts filtered by site/account for the clientAlert Detail:
{
"alertId": "1234567890",
"name": "Suspicious PowerShell Execution",
"severity": "HIGH",
"status": "NEW",
"detectedAt": "2026-02-24T08:15:00.000Z",
"viewType": "ALL",
"endpointName": "ACME-WS-042",
"siteName": "Acme Corporation",
"accountName": "MSP Partner Account",
"description": "PowerShell process executed encoded command that downloads and executes remote payload",
"mitreAttackTechniques": ["T1059.001", "T1027", "T1105"],
"indicators": [
{"type": "IP", "value": "203.0.113.42"},
{"type": "SHA256", "value": "abc123..."}
]
}
Alert History:
[
{
"timestamp": "2026-02-24T08:15:00.000Z",
"action": "CREATED",
"details": "Alert created by detection engine"
},
{
"timestamp": "2026-02-24T08:30:00.000Z",
"action": "STATUS_CHANGED",
"details": "Status changed from NEW to IN_PROGRESS",
"actor": "analyst@msp.com"
}
]
| Error | Cause | Resolution |
|---|---|---|
| Alert not found | Invalid alertId | Verify the alert ID with list_alerts |
| Invalid severity filter | Wrong severity value | Use CRITICAL, HIGH, MEDIUM, LOW, INFO, or UNKNOWN |
| Invalid status filter | Wrong status value | Use NEW, IN_PROGRESS, RESOLVED, or FALSE_POSITIVE |
| Invalid view type | Wrong viewType value | Use ALL, CLOUD, KUBERNETES, IDENTITY, etc. |
| Empty results | No matching alerts | Widen filters or check time range |
| Authentication error | Invalid token | Verify Service User token is Account or Site level |
purple_ai to investigate the threat context of any alert