Skip to content

SentinelOne get-file response action [classic] #5499

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joepeeples merged 1 commit into from
Jul 3, 2024
Merged

SentinelOne get-file response action [classic] #5499

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/management/admin/response-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,10 +106,18 @@ Required privilege: *Process Operations*
Example: `suspend-process --pid 123 --comment "Suspend suspicious process"`

[discrete]
[[get-file]]
=== `get-file`

Retrieve a file from a host. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.

[NOTE]
====
Files retrieved from third-party-protected hosts require a different password. Refer to the following:

* <<sentinelone-response-actions>>
====

You must include the following parameter to specify the file's location on the host:

* `--path` : The file's full path (including the file name).
Expand Down
10 changes: 10 additions & 0 deletions docs/management/admin/third-party-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,12 @@ preview::[]

You can direct SentinelOne to perform response actions on protected hosts without leaving the {elastic-sec} UI. Prior <<response-actions-config,configuration>> is required to connect {elastic-sec} with SentinelOne.

.Requirements
[sidebar]
--
Third-party response actions require an https://www.elastic.co/pricing[Enterprise subscription], and each response action type has its own user role privilege requirements. Refer to <<response-actions>> for more information.
--

The following response actions and related features are supported for SentinelOne-protected hosts:

* **Isolate and release a host** using any of these methods:
Expand All @@ -25,4 +31,8 @@ The following response actions and related features are supported for SentinelOn
+
Refer to the instructions on <<isolate-a-host,isolating>> and <<release-a-host,releasing>> hosts for more details.

* **Retrieve a file from a host** with the <<get-file,`get-file` response action>>.
+
NOTE: For SentinelOne-protected hosts, you must use the password `Elastic@123` to open the retrieved file.

* **View past response action activity** in the <<response-actions-history,response actions history>> log.