Metrics Library

This metric is helpful to manage if any Endpoint has an outdated Agent. This metric is useful as it prevents endpoints from having vulnerable software installed. Agents[?isUpToDate == 'false' && networkStatus == 'connected'].computerName

Returns the number of active licenses for SentinelOne Singularity Control. Add a different sku to return other licenses. This is a useful metric when reconciling services in the Gradient MSP billing module. SystemInfo.activeLicenses || sku == 'Control' Update use the following query instead:to_number(SystemInfo.sku == Control && ~.SystemInfo.totalLicenses | replace(to_string(@), to_string( false ), to_string( 0 )))

Use to identify systems needing updates Agents[?isUpToDate == false ].[computerName, agentVersion]

Total Count of Sentinel One Agents Agents[]| length(@)

Metrics returns a list of active sentinelone launchpoints that are in a failed run state. Launchpoints[? Inspector.Name == sentinelone-inspector && RunState.Status != Completed && Status != Discovered:Unconfigured && Status != Discovered:Configured ] .join( : ,[to_string(FriendlyName),to_string(RunState.Status)])

This metric will find if a Site has it's policy set to detect mode. Will be useful for alerting if this client should be in protect mode. Policies[?mitigationMode== detect || mitigationModeSuspicious=='detect'].{mitigationMode: mitigationMode, mitigationModeSuspicious: mitigationModeSuspicious}

This metric will find if a Group has it's policy set to detect mode. Will be useful for alerting if this client should be in protect mode. Groups[?GroupPolicyInformation.mitigationMode== detect || GroupPolicyInformation.mitigationModeSuspicious=='detect'].{GroupName: name, mitigationMode: GroupPolicyInformation.mitigationMode, mitigationModeSuspicious: GroupPolicyInformation.mitigationModeSuspicious}

Export a listing of CVEs as reported by the sentinelone agent. ApplicationCVEs[].[createdAt, cveId, description, id, link, riskLevel, score, publishedAt, updatedAt]

Used to sync total active licenses with Synthesize Billing. SystemInfo.activeLicenses || to_number('0')

Adjust as needed - working on some reporting KPI metrics and wanted to share. Credit to support for the query! Current unresolved threats Threats[? time_since(threatInfo.createdAt, days ) < 30 && threatInfo.incidentStatus == unresolved ][ Threat Name: threatInfo. threatName, | Path: threatInfo.filePath, | Status: threatInfo.incidentStatusDescription] | length(@) Unresolved threats over 30d Threats[? time_since(threatInfo.createdAt, days ) > 30 && threatInfo.incidentStatus == unresolved ][ Threat Name: threatInfo. threatName, | Path: threatInfo.filePath, | Status: threatInfo.incidentStatusDescription] | length(@) Resolved threats last 30d Threats[? time_since(threatInfo.createdAt, days ) < 30 && threatInfo.incidentStatus == resolved ][ Threat Name: threatInfo. threatName, | Path: threatInfo.filePath, | Status: threatInfo.incidentStatusDescription] | length(@)