The "Socrates Tool - Scan Device on SentinelOne" workflow template is designed to streamline endpoint security by automating full disk scans on devices under investigation. This workflow is triggered when an Agent ID is provided, either directly by Socrates or retrieved from custom fields. It initiates a scan using SentinelOne, waits for a predefined period, and then checks the scan status. This process enhances threat detection and response capabilities, supporting case management and threat hunting activities.
Use Cases
Case Management , Endpoint Detection and Response (EDR) , Threat Hunting
Workflow Breakdown
This Workflows is triggered by Socrates adding an Agent ID as Parameter.
If Socrates does not provide an Agent ID, workflow will look for the value in custom fields.
Submit Scan action to SentinelOne.
Waits a predefined time before looking-up for the status of the scan.
Vendors
Utils, SentinelOne, Torq Cases