hawk-soar-app-sentinelone-capture-sample

SentinelOne threat file capture app for HAWK.io SOAR.

This app migrates the Python flow in threat_fetch_file.py to Node.js:

1. request file fetch from SentinelOne by content hash
2. resolve download URL from activities
3. download the file bytes
4. persist the file for investigation (do not discard)

Transport

This app is invoked through the SOAR websocket stream handler (cmd + route message format).

• No HTTP GET/POST endpoints are exposed by this app.
• registerRoutes is intentionally empty.

Websocket route

• capture (aliases: fetch, download)

Inputs (message.data)

Required integration fields:

• group_id
• credential_id
• action_id
• case_id
• token

File selector (one required):

• filename (or fileName, file_name)
• contentHash (or fileContentHash, sha1, hash)
• body (treated as filename unless it looks like a hash)

Optional:

• password (default: MySecretPass123!)
• activityLimit (default: 1000)

Example: capture by filename

{
  "id": "1",
  "cmd": "hawk-soar-app-sentinelone-capture-sample",
  "route": "capture",
  "data": {
    "group_id": "grp-root",
    "credential_id": "#12:0",
    "action_id": "#13:0",
    "case_id": "#45:0",
    "token": "session-token",
    "filename": "suspicious.dll"
  }
}

Example: capture by hash

{
  "id": "2",
  "cmd": "hawk-soar-app-sentinelone-capture-sample",
  "route": "capture",
  "data": {
    "group_id": "grp-root",
    "credential_id": "#12:0",
    "action_id": "#13:0",
    "case_id": "#45:0",
    "token": "session-token",
    "contentHash": "3bf8eabdef9dd1790917b648d4d52a5089afd9a7"
  }
}

Websocket response shape

Success:

{
  "id": "1",
  "cmd": "hawk-soar-app-sentinelone-capture-sample",
  "route": "capture",
  "status": true,
  "code": 200,
  "details": "Successfully captured SentinelOne threat file and saved investigation artifact.",
  "data": {
    "filename": "suspicious.dll",
    "contentHash": "3bf8eabdef9dd1790917b648d4d52a5089afd9a7",
    "sha256": "....",
    "sizeBytes": 12345,
    "localPath": "/tmp/hawk-sentinelone-captures/....-suspicious.dll",
    "storedAsArtifact": true,
    "storage": {
      "backend": "quarantine.set",
      "expires": "-1",
      "includesBase64": true
    }
  }
}

Failure:

{
  "id": "1",
  "cmd": "hawk-soar-app-sentinelone-capture-sample",
  "route": "capture",
  "status": false,
  "code": 500,
  "details": "error message"
}

Output

Successful response message.data includes:

• filename
• contentHash
• sha256
• sizeBytes
• localPath
• storedAsArtifact
• storage

Investigation retention behavior

This app preserves the downloaded file for continued investigation by:

• writing a local copy to /tmp/hawk-sentinelone-captures
• storing file metadata and full file_content_base64 using quarantine.set
• forcing non-expiration (expires = -1) on the saved record

Operational note

Because dynamic app exports currently provide quarantine.set (not artefacts.set), persisted investigation evidence is stored through the quarantine record path.