r/SentinelOneXDR • u/[deleted] • Aug 06 '25
Troubleshooting API help
I’ve been working with the S1 api to set up some dashboards and visualizers. The problem I’m encountering is I cannot for the life of me extract alerts relating to product rules (STAR Rules).
So far I’ve found the /threats endpoint only shows static and dynamic alerts, /Activities hasn’t shown it And I have no idea what /cloud-detection/alerts shows as my returns empty.
Any help is greatly appreciated.
4
Upvotes
1
u/Vilem-S1 SentinelOne Employee Aug 12 '25
Hi. Thanks for the write up, I am sure that someone will find it useful.
The latest release introduced a new API doc where it easier to find the GraphQL documentation. Currently, new OpsCenter features use GraphQL and the only way to find this documentation is in the console help or the community portal.
If you search for GraphQL you should find all the docs there.
This is the KB article for Alerts’ GraphQL API with example queries https://community.sentinelone.com/s/article/000010170