The "QuickAction - Scan Device on SentinelOne" workflow template streamlines endpoint security by enabling rapid initiation of a Full Disk Scan on devices using SentinelOne Agent. Designed for case management and threat hunting, this workflow triggers upon Quick Action execution, sending scan commands and updating case notes with results. Ideal for enhancing Endpoint Detection and Response (EDR) efficiency, it supports frameworks like MITRE and NIST.
Use Cases
Case Management , Endpoint Detection and Response (EDR) , Threat Hunting
Workflow Breakdown
Runs in response of a Quick Action execution.
Send a Full Disk Scan command to SentinelOne Agent
Add a Note to the Case with the result of the action.
Vendors
Utils, SentinelOne, Torq Cases
Workflow Output
Scan initiation status and timestamp.