[Request] Document the get-file response action availability for SentinelOne hosts

[paul-tavares]

Description

We are introducing the ability for users to do a get-file response action operation against SentinelOne hosts. The response action is very similar to the one already available for Endpoint with the only significant difference being the passcode used to access the ZIP file with the file contents. For SentinelOne that passcode is Elastic@123

Background & resources

• Tracking issue: https://github.com/elastic/security-team/issues/9681
• Issues/metas: https://github.com/elastic/security-team/issues/6200
• Point of contact: Paul Tavares
• Test environments:
  • A cloud env. can be initiated to validate this feature if necessary. Ensure that the following feature flag is enabled: responseActionsSentinelOneGetFileEnabled

Which documentation set does this change impact?

ESS and serverless

ESS release

8.15

Serverless release

The week of June 24 (target)

Feature differences

The feature is identical in all environments

API docs impact

No changes to API docs. The agent_type of sentinel_one is now accepted for the get-file api

Prerequisites, privileges, feature flags

• A connector must be setup to SentinelOne
• Env. is running Enterprise license (on ESS) or the Complete endpoint tier on serverless
• user should have privileges in their role to perform file operations

---

Pull requests

Preview Give feedback

1. SentinelOne get-file response action [serverless] #5444
   Docset: Serverless Feature: Response actions Team: EDR Workflows backport-skip ci:doc-build +5
   
2. SentinelOne get-file response action [classic] #5499
   Docset: ESS Feature: Response actions Team: EDR Workflows v8.15.0 +4
   

[joepeeples]

Updated in both serverless and classic 8.15 docs, closing the issue