[adulau]

Summary

Add sentinelone_ioc_publish, a blocking workflow action that publishes IDS-marked MISP event and object indicators to SentinelOne Threat Intelligence through /web/api/v2.1/threat-intelligence/iocs.

• Require one explicit account or site scope. Read the HTTPS console origin and API token from the module server environment, and use TLS verification without redirects.
• Support MD5, SHA-1, SHA-256, domains/hostnames, URLs, IPv4/IPv6 and supported composites. Validate, normalize and deduplicate indicators while preserving MISP source references. Existing file and domain-ip objects suffice.
• Provide credential-free dry runs, configurable severity and expiry, and deterministic external IDs. Check exact identity and scope before creation, validate acknowledgements, and report per-indicator outcomes and partial failures without automatically retrying writes.
• Add a setup/lifecycle guide and generated module catalog entries. No new dependencies are needed.

Lifecycle and scope

SentinelOne's native IOC API has no update endpoint. Matching, unexpired records are returned as existing and remain unchanged, including expiry and severity. Expired, ambiguous or mismatched records fail without mutation; this action never deletes or recreates existing IOCs. Lookup/create operations are not transactional, so concurrent runs may race and uncertain write outcomes require inspection before retrying. Threat Intelligence publication does not automatically enforce an endpoint blocklist.

Expiry defaults to 14 days and respects the documented 30-day maximum for IPs and 180-day maximum for other supported types. Inputs are limited to 100 unique indicators, with per-request timeouts and a processing budget.

API fields, endpoints and response schemas were checked against SentinelOne's Threat Intelligence reference and its v2.1 Swagger specification.

Validation

• 94 new tests cover account/site wire contracts, real requests serialization with mocked HTTP transport, module discovery/query endpoints, existing records, malformed or partial responses, input/object handling, configuration, expiry, deadlines and partial publication.
• pytest -q tests/test_sentinelone_ioc_publish.py tests/test_crowdstrike_ioc_publish.py tests/test_elastic_ecs_export.py tests/test_splunk_export.py: 352 passed (one pre-existing Python deprecation warning).
• Black and isort checks, scoped flake8, and git diff --check pass.
• No live SentinelOne tenant was used; API permissions and tenant-specific behavior require deployment validation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T18:14:50.081072Z	8148006	PR opened
🔒 Security Review	✅ Completed 2026-10-18T18:15:33.070544Z	8148006	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.