The "QuickAction - Run a RemoteScript on a device with SentinelOne" workflow template streamlines endpoint management by allowing SOC analysts to execute remote scripts directly on devices under investigation. This tool enhances incident response by facilitating script selection, input parameter configuration, and execution on targeted agents, ensuring efficient threat eradication and network security remediation.
Use Cases
Case Management , Endpoint Detection and Response (EDR) , Remediate Network Security Alerts , Threat Hunting
Workflow Breakdown
Read available scripts from SentinelOne.
Let the user select a script and add necessary input parameters.
Submit the script to be executed only on the agent analyzed in the case.
Wait for the response, download it, and decode it.
Vendors
Scripting, Utils, HTTP, SentinelOne, Torq Cases