SentinelOne Tables

Tables

SentinelOneAccounts

Represents all SentinelOne customer accounts, including licensing allocations, SKUs, creation metadata, and account activity across environments.

Name	Type	Description
ID	string	Unique identifier for the record.
ExternalID	string	External identifier for the entity in SentinelOne.
Name	string	Name of the configuration or entity.
State	string	Lifecycle state of the account.
CreatedAt	datetime	Date and time the record was created in SentinelOne.
UpdatedAt	datetime	Date and time the record was last updated in SentinelOne.
Expiration	datetime	Expiration date of the account or license.
UnlimitedExpiration	boolean	Indicates whether the account has unlimited expiration.
IsDefault	boolean	Indicates whether this is the default group or policy for its scope.
AccountType	string	Type of SentinelOne account.
Creator	string	Display name of the user who created the record.
CreatorID	string	Identifier of the user who created the record.

SentinelOneAccountSKUs

Defines licensing SKUs for each SentinelOne account, reflecting license volumes, limitations, and usage distribution.

Name	Type	Description
ID	integer	Unique identifier for the record.
AccountID	string	Identifier of the SentinelOne account in scope.
Type	string	Type discriminator for the group or entity.
TotalLicenses	integer	Numeric value for Total Licenses.
Unlimited	boolean	Boolean flag for Unlimited.
AgentsInSku	integer	Numeric value for Agents In Sku.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneActiveDirectoryComputerGroups

Captures AD computer group memberships for endpoints, linking AD structure with SentinelOne agent identity.

Name	Type	Description
ID	integer	Unique identifier for the record.
AgentID	string	Identifier of the SentinelOne agent related to this record.
GroupName	string	Name of the Active Directory or SentinelOne group.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneActiveDirectoryUserGroups

Maps SentinelOne-monitored devices to AD user groups, enriching identity-based threat correlation.

Name	Type	Description
ID	integer	Unique identifier for the record.
AgentID	string	Identifier of the SentinelOne agent related to this record.
GroupName	string	Name of the Active Directory or SentinelOne group.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneActivities

Logs all activity events across SentinelOne agents, sites, and accounts, giving detailed visibility into operations, behavioral events, and threat-related actions.

Name	Type	Description
ID	string	Unique identifier for the record.
AccountID	string	Identifier of the SentinelOne account in scope.
AccountName	string	Name of the SentinelOne account in scope.
FullScopeDetails	string	Full textual scope details for the event (account/site/group path).
FullScopeDetailsPath	string	Hierarchical scope path string for the event.
IPAddress	string	SentinelOne field: IP Address.
SiteName	string	Name of the SentinelOne site in scope.
SourceType	string	Source type of the activity event.
LastLoggedInUserName	string	Last logged-in username reported by the agent.
ComputerName	string	Computer / hostname related to the event or agent.
DeviceClass	string	SentinelOne field: Device Class.
DeviceName	string	SentinelOne field: Device Name.

SentinelOneAgentActiveDirectories

Provides the AD identity context (computer and user DN) associated with each SentinelOne agent, supporting identity-aware threat investigation.

Name	Type	Description
ID	integer	Unique identifier for the record.
AgentID	string	Identifier of the SentinelOne agent related to this record.
ComputerDistinguishedName	string	SentinelOne field: Computer Distinguished Name.
LastUserDistinguishedName	string	SentinelOne field: Last User Distinguished Name.
UserPrincipalName	string	SentinelOne field: User Principal Name.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneAgentInstalledApplications

Contains full inventory of installed applications across SentinelOne-managed endpoints, enriched with agent context, application metadata, signatures, and security risk classification.

Name	Type	Description
ID	string	Unique identifier for the record.
AgentID	string	Identifier of the SentinelOne agent related to this record.
AgentUUID	string	SentinelOne field: Agent UUID.
AgentComputerName	string	Computer name of the agent at detection time.
AgentDomain	string	SentinelOne field: Agent Domain.
AgentNetworkStatus	string	Network connectivity / quarantine status of the agent at detection time.
AgentOperationalState	string	SentinelOne field: Agent Operational State.
AgentVersion	string	SentinelOne agent software version.
AgentIsActive	boolean	Boolean flag for Agent Is Active.
AgentIsDecommissioned	boolean	Boolean flag for Agent Is Decommissioned.
AgentInfected	boolean	Indicates whether the agent was marked infected at detection time.
AgentMachineType	string	SentinelOne field: Agent Machine Type.

SentinelOneAgentIPv4Addresses

Stores IPv4 addresses discovered on SentinelOne agents, tied to specific network interfaces for each endpoint.

Name	Type	Description
IPv4Address	string	SentinelOne field: I Pv4 Address.
InterfaceID	string	SentinelOne field: Interface ID.
AgentID	string	Identifier of the SentinelOne agent related to this record.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneAgentIPv6Addresses

Captures IPv6 addresses assigned to network interfaces on SentinelOne-protected endpoints.

Name	Type	Description
IPv6Address	string	SentinelOne field: I Pv6 Address.
InterfaceID	string	SentinelOne field: Interface ID.
AgentID	string	Identifier of the SentinelOne agent related to this record.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneAgentLocations

Maps agents to SentinelOne-defined locations, useful for organizing endpoints by site, network, or logical grouping.

Name	Type	Description
LocationID	string	Identifier of the location record.
Name	string	Name of the configuration or entity.
Scope	string	Scope assignment for the user or role.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneAgentNetworkInterfaces

Describes the network interfaces of SentinelOne-protected endpoints, including gateways and physical/virtual status.

Name	Type	Description
InterfaceID	string	SentinelOne field: Interface ID.
AgentID	string	Identifier of the SentinelOne agent related to this record.
Name	string	Name of the configuration or entity.
Physical	string	SentinelOne field: Physical.
GatewayIP	string	SentinelOne field: Gateway IP.
GatewayMacAddress	string	SentinelOne field: Gateway Mac Address.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneAgents

Provides a comprehensive inventory of all SentinelOne agents, including OS, hardware, licensing, operational state, and security posture metadata for each endpoint.

Name	Type	Description
ID	string	Unique identifier for the record.
ExternalID	string	External identifier for the entity in SentinelOne.
ComputerName	string	Computer / hostname related to the event or agent.
Domain	string	Windows / network domain of the endpoint.
OSName	string	Operating system name of the endpoint.
OSArch	string	Operating system architecture (e.g. `64 bit`).
OSType	string	Operating system type (`windows`, `linux`, `macos`).
OSRevision	string	Operating system revision / build string.
OSUsername	string	Last known OS username on the endpoint.
IsActive	boolean	Indicates whether the agent is currently active / connected.
IsUninstalled	boolean	Indicates whether the agent has been uninstalled.
IsPendingUninstall	boolean	Indicates whether an uninstall is pending.

SentinelOneApplications

Aggregates vulnerability and deployment information for applications discovered across SentinelOne-managed endpoints.

Name	Type	Description
ApplicationID	string	SentinelOne field: Application ID.
CVECount	integer	Numeric value for CVE Count.
DaysDetected	integer	Numeric value for Days Detected.
DetectionDate	datetime	Date and time for Detection Date.
EndpointCount	integer	Numeric value for Endpoint Count.
Estimate	boolean	Boolean flag for Estimate.
HighestNVDBaseScore	string	SentinelOne field: Highest NVD Base Score.
HighestSeverity	string	SentinelOne field: Highest Severity.
Name	string	Name of the configuration or entity.
Vendor	string	Software vendor name.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneCVEs

Tracks individual CVE findings across applications and endpoints, combining CVSS, NVD, risk scoring, mitigation state, and environment context.

Name	Type	Description
ID	string	Unique identifier for the record.
Application	string	SentinelOne field: Application.
ApplicationName	string	SentinelOne field: Application Name.
ApplicationVendor	string	SentinelOne field: Application Vendor.
InactiveApplication	string	SentinelOne field: Inactive Application.
InactiveApplicationVendor	string	SentinelOne field: Inactive Application Vendor.
ApplicationVersion	string	SentinelOne field: Application Version.
BaseScore	string	SentinelOne field: Base Score.
CVEID	string	Common Vulnerabilities and Exposures identifier.
CVSSVersion	string	SentinelOne field: CVSS Version.
DaysDetected	integer	Numeric value for Days Detected.
DetectionDate	datetime	Date and time for Detection Date.

SentinelOneGroups

Stores SentinelOne group records used to organize endpoints within a site and apply shared policy configurations.

Name	Type	Description
ID	string	Unique identifier for the record.
Name	string	Name of the configuration or entity.
Description	string	Free-text description of the group or entity.
SiteID	string	Identifier of the SentinelOne site in scope.
Type	string	Type discriminator for the group or entity.
Inherits	boolean	Indicates whether the group inherits policy from its parent.
IsDefault	boolean	Indicates whether this is the default group or policy for its scope.
Creator	string	Display name of the user who created the record.
CreatorID	string	Identifier of the user who created the record.
Rank	integer	Sort / priority rank of the group.
TotalAgents	integer	Number of agents currently assigned to the group.
FilterID	string	Dynamic group filter identifier, when the group is filter-based.

SentinelOnePolicies

Contains SentinelOne policy configurations that define agent detection behavior and automated mitigation actions within a given scope.

Name	Type	Description
ScopeType	string	Policy scope level: Group, Site, Account, or Tenant.
ScopeID	string	Identifier of the scoped entity (group/site/account id; tenant uses a sentinel scope id).
InheritedFrom	string	Scope from which this policy is inherited, when applicable.
MitigationModeThreats	string	Policy mitigation mode for confirmed threats (e.g. `detect`, `protect`).
MitigationModeSuspicious	string	Policy mitigation mode for suspicious detections.
AutoMitigationAction	string	Automatic mitigation action configured by the policy.
NetworkQuarantineEnabled	boolean	Indicates whether network quarantine (isolation) is enabled by policy or on the agent.
FwForNetworkQuarantineEnabled	boolean	Indicates whether firewall rules for network quarantine are enabled.
IsDefault	boolean	Indicates whether this is the default group or policy for its scope.
CreatedAt	datetime	Date and time the record was created in SentinelOne.
UpdatedAt	datetime	Date and time the record was last updated in SentinelOne.
AgentLoggingOn	boolean	Indicates whether agent Logging On is enabled.

SentinelOneRoles

Defines available roles in SentinelOne, including permissions scope, ownership, and usage counts across users and sites.

Name	Type	Description
ID	string	Unique identifier for the record.
AccountName	string	Name of the SentinelOne account in scope.
CreatedAt	datetime	Date and time the record was created in SentinelOne.
Creator	string	Display name of the user who created the record.
Description	string	Free-text description of the group or entity.
Name	string	Name of the configuration or entity.
PredefinedRole	boolean	Boolean flag for Predefined Role.
Scope	string	Scope assignment for the user or role.
ScopeID	string	Identifier of the scoped entity (group/site/account id; tenant uses a sentinel scope id).
SiteName	string	Name of the SentinelOne site in scope.
UpdatedAt	datetime	Date and time the record was last updated in SentinelOne.
UsersInRoles	integer	Numeric value for Users In Roles.

SentinelOneThreatMitigations

Records mitigation actions applied to SentinelOne threats, including action type, execution status, and associated agent and timestamps.

Name	Type	Description
RecordID	string	Stable composite key for the mitigation row (`threatId`, `action`, `reportId`, `startedAt`).
ThreatID	string	Parent SentinelOne threat identifier.
Action	string	Mitigation action performed (e.g. kill, quarantine, remediate, rollback).
Status	string	Status of the mitigation action.
MitigationStartedAt	datetime	Date and time the mitigation action started.
MitigationEndedAt	datetime	Date and time the mitigation action ended.
LastUpdatedAt	datetime	Date and time the mitigation status was last updated.
ReportID	string	Identifier of the mitigation report produced by the agent.
LatestReport	string	Latest mitigation report summary or path returned by the agent.
AgentSupportsReport	boolean	Indicates whether the agent supports mitigation reporting.
GroupNotFound	boolean	Indicates whether the agent group could not be found during mitigation.
ActionsSuccess	integer	Count of successful mitigation sub-actions.

SentinelOneThreats

Primary table of threats detected by SentinelOne agents, including classification, confidence level, mitigation status, verdict, and detection timestamps.

Name	Type	Description
ID	string	SentinelOne threat identifier (threat id).
ThreatName	string	Display name of the detected threat.
Classification	string	Threat classification assigned by SentinelOne engines (e.g. `Malware`, `Exploit`).
ClassificationSource	string	Source that produced the classification (e.g. `engine`, `cloud`).
ConfidenceLevel	string	Confidence level of the detection (e.g. `malicious`, `suspicious`).
DetectionType	string	Detection type / engine category for the threat.
IncidentStatus	string	Current incident / analyst workflow status of the threat.
IncidentStatusDescription	string	Human-readable description of the incident status.
AnalystVerdict	string	Analyst verdict applied to the threat (e.g. `true_positive`, `false_positive`).
AnalystVerdictDescription	string	Human-readable description of the analyst verdict.
MitigationStatus	string	Overall mitigation status of the threat.
MitigationStatusDescription	string	Human-readable description of the mitigation status.

SentinelOneThreatTimelineEvents

Stores chronological event records associated with a SentinelOne threat, capturing the sequence of process, file, network, and registry activities observed during execution.

Name	Type	Description
ID	string	Unique identifier for the record.
ThreatID	string	Parent SentinelOne threat identifier.
ActivityType	integer	Numeric SentinelOne activity type code for the timeline event.
CreatedAt	datetime	Date and time the record was created in SentinelOne.
UpdatedAt	datetime	Date and time the record was last updated in SentinelOne.
PrimaryDescription	string	Primary human-readable description of the event.
SecondaryDescription	string	Secondary / supplemental description of the event.
AgentID	string	Identifier of the SentinelOne agent related to this record.
Hash	string	Content hash associated with the event (often SHA-1).
OsFamily	string	Operating system family related to the event.
AccountID	string	Identifier of the SentinelOne account in scope.
SiteID	string	Identifier of the SentinelOne site in scope.

SentinelOneUserActions

Holds definitions of user actions configured in SentinelOne, which can be associated with agents, events, or automation flows.

Name	Type	Description
Name	string	Name of the configuration or entity.
ConfigID	integer	The ID of the configuration within Compyl.
BatchDate	datetime	The date and time data was synced to our database.

SentinelOneUsers

Contains user account information for SentinelOne console access, including identity, login activity, API token status, and 2FA configuration.

Name	Type	Description
ID	string	Unique identifier for the record.
CanGenerateAPIToken	boolean	Boolean flag for Can Generate API Token.
APITokenCreatedAt	datetime	Date and time for API Token Created At.
APITokenExpiresAt	datetime	Date and time for API Token Expires At.
DateJoined	datetime	Date and time the user joined / was created.
Email	string	Email address of the console user.
EmailReadOnly	boolean	Boolean flag for Email Read Only.
EmailVerified	boolean	Boolean flag for Email Verified.
FirstLogin	datetime	Date and time for First Login.
FullName	string	Full name of the console user.
FullNameReadOnly	boolean	Boolean flag for Full Name Read Only.
GlobalOrganizationID	string	SentinelOne field: Global Organization ID.

Bridge Tables

SentinelOneRoles_SentinelOneUsers

Join table mapping SentinelOne users to their roles, enabling many-to-many role assignments across accounts and scopes.

Name	Type	Description
RoleID	string	Foreign key to SentinelOneRoles.ID.
UserID	string	Foreign key to SentinelOneUsers.ID.
ConfigID	integer	The ID of the configuration within Compyl.

SentinelOneAgents_SentinelOneUserActions

Connects agents to specific user actions or action definitions, recording which actions are associated with which endpoints.

Name	Type	Description
ID	string	Foreign key to SentinelOneAgents.ID.
Name	string	Foreign key to SentinelOneUserActions.Name.
ConfigID	integer	The ID of the configuration within Compyl.

SentinelOneAgents_SentinelOneAgentLocations

Represents the join between agents and location entities, defining which agents belong to which SentinelOne locations.

Name	Type	Description
ID	string	Foreign key to SentinelOneAgents.ID.
LocationID	string	Foreign key to SentinelOneAgentLocations.LocationID.
ConfigID	integer	The ID of the configuration within Compyl.