SentinelOne

Overview

Sync agents, threats, and vulnerabilities from SentinelOne into RegScale.

Command	Description
`regscale sentinelone sync_all`	Sync all SentinelOne data to RegScale. Synchronizes both assets (agents) and findings (threats and vulnerabilities) from SentinelOne to the specified RegScale record.
`regscale sentinelone sync_assets`	Sync SentinelOne agents to RegScale assets. Fetches all agents from SentinelOne and synchronizes them as assets into the specified RegScale record.
`regscale sentinelone sync_findings`	Sync SentinelOne threats and vulnerabilities to RegScale. Fetches threats and optionally vulnerabilities from SentinelOne, then synchronizes them as findings into the specified RegScale record.
`regscale sentinelone sync_threats`	Sync only threat detections from SentinelOne. Fetches threat detections from SentinelOne and synchronizes them as findings into the specified RegScale record.
`regscale sentinelone sync_vulnerabilities`	Sync only CVE vulnerabilities from SentinelOne Ranger. Fetches vulnerabilities from SentinelOne Ranger module and synchronizes them as findings into the specified RegScale record.
`regscale sentinelone test_connection`	Test connection to SentinelOne API. Verifies that the configured SentinelOne credentials are valid and the API is accessible.

Sync all SentinelOne data to RegScale.

Synchronizes both assets (agents) and findings (threats and vulnerabilities) from SentinelOne to the specified RegScale record.

regscale sentinelone sync_all [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_id, -id, --id`	integer	Yes	—	RegScale will create and update assets and findings as children of this record.
`--include-vulnerabilities, --no-include-vulnerabilities`	boolean	No	`true`	Include CVE vulnerabilities from Ranger (default: True).
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

Sync SentinelOne agents to RegScale assets.

Fetches all agents from SentinelOne and synchronizes them as assets into the specified RegScale record.

regscale sentinelone sync_assets [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_id, -id, --id`	integer	Yes	—	RegScale will create and update assets as children of this record.
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

Sync SentinelOne threats and vulnerabilities to RegScale.

Fetches threats and optionally vulnerabilities from SentinelOne, then synchronizes them as findings into the specified RegScale record.

regscale sentinelone sync_findings [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_id, -id, --id`	integer	Yes	—	RegScale will create and update findings as children of this record.
`--include-threats, --no-include-threats`	boolean	No	`true`	Include threat detections (default: True).
`--include-vulnerabilities, --no-include-vulnerabilities`	boolean	No	`true`	Include CVE vulnerabilities from Ranger (default: True).
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

Sync only threat detections from SentinelOne.

Fetches threat detections from SentinelOne and synchronizes them as findings into the specified RegScale record.

regscale sentinelone sync_threats [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_id, -id, --id`	integer	Yes	—	RegScale will create and update threats as children of this record.
`--resolved, --no-resolved`	boolean	No	—	Filter by resolved status (default: all threats).
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

Sync only CVE vulnerabilities from SentinelOne Ranger.

Fetches vulnerabilities from SentinelOne Ranger module and synchronizes them as findings into the specified RegScale record.

regscale sentinelone sync_vulnerabilities [OPTIONS]

Flag	Type	Required	Default	Description
`--regscale_id, -id, --id`	integer	Yes	—	RegScale will create and update vulnerabilities as children of this record.
`--dry-run, -dr`	boolean	No	`false`	Discover item counts without syncing. Returns JSON summary for Orchestration Hub.
`--offset`	integer	No	—	Skip this many items from the start (for parallel job splitting).
`--limit`	integer	No	—	Process at most this many items (for parallel job splitting).

Test connection to SentinelOne API.

Verifies that the configured SentinelOne credentials are valid and the API is accessible.

regscale sentinelone test_connection

This command takes no parameters.