skills.rest
Sentinel-One
Sentinel-OneOFFICIAL
Explore all skills by this author →
WebsiteGitHub

mgmt-console-api

Query and manage SentinelOne console resources via REST and GraphQL APIs.

59|30|Updated Aug 19, 2025
Search Tags:#rest api#sentinelone#purple ai#mgmt console#unified alert management
One-click install
npx skills add https://github.com/Sentinel-One/ai-siem --skill mgmt-console-api
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mgmt-console-api
Source: https://github.com/Sentinel-One/ai-siem/tree/main/plugins/s1-secops-skills/skills/mgmt-console-api
Command: npx skills add https://github.com/Sentinel-One/ai-siem --skill mgmt-console-api

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, s1_client, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive interface to the SentinelOne Management Console API, enabling users to query, update, create, and act on various console resources with ease.

Core Features & Use Cases

  • Unified Alert Management: Triage and manage alerts with bulk actions and advanced filtering capabilities.
  • Purple AI: Perform natural-language queries on SDL telemetry for insights and investigations.
  • API Access: Execute REST API calls and GraphQL queries directly through the Skill.
  • Use Case: Use the mgmt-console-api to list recent alerts, update the status of an alert, or perform a Purple AI query to find information about a specific indicator.

Quick Start

Run the 'mgmt-console-api list-alerts' command to list recent alerts.

Frequently Asked Questions about mgmt-console-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query and manage SentinelOne alerts in bulk?▼

To manage SentinelOne alerts in bulk, you can use unified alert management features to triage, update, and apply bulk actions with advanced filtering capabilities via the Management Console API.

What is the best way to investigate SDL telemetry using natural language?▼

The best way to investigate SDL telemetry is using Purple AI, which allows you to perform natural-language queries on the data to retrieve specific insights and indicators.

Can I execute GraphQL queries directly against the SentinelOne Management Console?▼

Yes, you can execute both REST API calls and GraphQL queries directly through the interface to query, update, create, and act on various console resources like agents and threats.

Do I need an API token to manage SentinelOne agents and threats?▼

Yes, you need a valid S1 Console API token to authenticate and perform administrative and operational tasks for managing agents, threats, and other resources.

How do I list recent alerts from the SentinelOne console?▼

To list recent alerts, you can run the 'mgmt-console-api list-alerts' command, which queries the console API and retrieves the latest alert data.

Are there limitations when using the SentinelOne console API for operational tasks?▼

The API interface focuses on administrative and operational tasks within the SentinelOne ecosystem, meaning actions are bound by the permissions and rate limits of your valid S1 Console API token.

Related Skills

Explore More Software Engineering Skills→
okbest2024okbest2024

qq-bot-connect

Connect to the QQ Open Platform API via WebSocket with token authentication.

Community
Advanced
ancolemanancoleman
503

siem-logging

Configure SIEM systems for threat detection, log aggregation, and compliance.

Community
Advanced
claude-office-skillsclaude-office-skills
368

Security Monitoring

Automate security monitoring, threat detection, and incident response workflows.

Official
Advanced
JhabbigJhabbig

api-design-principles

Design REST and GraphQL APIs with resource-oriented naming and HTTP semantics.

Community
Advanced