SentinelOne Vulnerabilities

SentinelOne XSPM Vulnerability Management

Overview

Vulnerabilities in SentinelOne are tracked through the Extended Security Posture Management (XSPM) module. The platform identifies CVEs across managed endpoints, cloud workloads, and applications, enriching them with EPSS (Exploit Prediction Scoring System) scores, exploit maturity data, and remediation guidance. For MSPs, vulnerability management is a core service -- tracking which client endpoints have unpatched critical CVEs, prioritizing patches based on exploit likelihood, and reporting on vulnerability posture during quarterly business reviews.

All vulnerability tools are read-only. You can view, search, and report on vulnerabilities, but you cannot change vulnerability status, apply patches, or take remediation actions through the MCP tools.

Anti-triggers

• A bad setting rather than a missing patch. Exposed buckets, permissive firewall rules, and unrotated keys are the sibling XSPM surface with an identical tool shape — use sentinelone-misconfigurations.
• "Remediation" meaning deploying the patch. These tools report; they do not patch or change status. Identify affected endpoints with sentinelone-inventory, then drive the actual patch job from the RMM.
• Exposure discovered by scanning rather than by an agent. CVEs here come from endpoints already running a SentinelOne agent; open ports and service banners on unmanaged devices are runzero-services.

MCP Tools

Available Tools

List Vulnerabilities

Call list_vulnerabilities with optional parameters:

• Filter by severity: Set severity to CRITICAL, HIGH, MEDIUM, LOW, or INFO
• Filter by status: Set status to one of the allowed values (see Status Values below)
• Sort results: Set sortBy (e.g., severity, epssScore, detectedAt) and sortOrder (ASC or DESC)
• Paginate: Set limit and use cursor from the response for subsequent pages

Example: List all critical vulnerabilities:

• list_vulnerabilities with severity=CRITICAL, sortBy=epssScore, sortOrder=DESC

Example: List vulnerabilities awaiting patches:

• list_vulnerabilities with status=TO_BE_PATCHED, limit=50

Search Vulnerabilities

Call search_vulnerabilities with a filters array for complex queries:

Example: Search for a specific CVE:

• search_vulnerabilities with filters=[{"fieldId": "cveId", "filterType": "EQUALS", "values": ["CVE-2024-1234"]}]

Example: Search for exploitable vulnerabilities:

• search_vulnerabilities with filters=[{"fieldId": "exploitMaturity", "filterType": "EQUALS", "values": ["ACTIVE"]}]

Get Vulnerability Details

Call get_vulnerability with the vulnerabilityId to retrieve full details including CVE information, EPSS score, affected assets, and remediation guidance.

Get Vulnerability Notes

Call get_vulnerability_notes with the vulnerabilityId to retrieve analyst comments and tracking notes.

Get Vulnerability History

Call get_vulnerability_history with the vulnerabilityId to retrieve the timeline of status changes and updates.

Key Concepts

Vulnerability Status Values

Severity Levels

EPSS Scores

The Exploit Prediction Scoring System (EPSS) provides a probability score (0.0 to 1.0) indicating how likely a vulnerability is to be exploited in the next 30 days:

Exploit Maturity

GraphQL Filter Syntax

Search tools use GraphQL filters:

{
  "fieldId": "severity",
  "filterType": "EQUALS",
  "values": ["CRITICAL"]
}

Common filter fields: cveId, severity, status, epssScore, exploitMaturity, siteName, endpointName, applicationName, detectedAt.

Field Reference

Core Vulnerability Fields

Common Workflows

Critical Vulnerability Review

1. Call list_vulnerabilities with severity=CRITICAL, status=NEW, sortBy=epssScore, sortOrder=DESC
2. Review each vulnerability's EPSS score and exploit maturity
3. For high-EPSS vulnerabilities, call get_vulnerability for full details
4. Group by client (siteName) to identify which clients are most exposed
5. Prioritize remediation based on EPSS score and exploit maturity

Vulnerability Audit by Client

1. Call search_vulnerabilities with filters=[{"fieldId": "siteName", "filterType": "EQUALS", "values": ["Client Name"]}]
2. Aggregate by severity: count CRITICAL, HIGH, MEDIUM, LOW
3. Identify top CVEs by EPSS score
4. Check for any actively exploited vulnerabilities (exploitMaturity=ACTIVE)
5. Generate a client-specific vulnerability report

Patch Prioritization

1. Call list_vulnerabilities with status=TO_BE_PATCHED, sortBy=epssScore, sortOrder=DESC
2. Focus on vulnerabilities with exploitMaturity of ACTIVE or WEAPONIZED
3. Group by application to identify which patches address the most vulnerabilities
4. Generate a prioritized patch list by client

Vulnerability Trending

1. Call list_vulnerabilities for the current period
2. Compare with previous period to identify new vulnerabilities
3. Calculate remediation rates (resolved / total)
4. Track EPSS score distribution changes
5. Report on vulnerability posture improvement or degradation

QBR Vulnerability Report

1. Call search_vulnerabilities filtered by client site
2. Count by severity and status
3. Highlight CRITICAL and HIGH with ACTIVE exploit maturity
4. Show remediation progress (resolved vs. new over the period)
5. List top 5 CVEs by EPSS score with remediation recommendations

Response Examples

Vulnerability Detail:

{
  "vulnerabilityId": "vuln-abc-123",
  "cveId": "CVE-2024-21887",
  "name": "Ivanti Connect Secure Authentication Bypass",
  "severity": "CRITICAL",
  "status": "NEW",
  "cvssScore": 9.1,
  "epssScore": 0.97,
  "exploitMaturity": "ACTIVE",
  "detectedAt": "2026-02-24T06:00:00.000Z",
  "siteName": "Acme Corporation",
  "endpointName": "ACME-VPN-01",
  "applicationName": "Ivanti Connect Secure",
  "applicationVersion": "9.1R17",
  "remediationSteps": "Upgrade to version 9.1R18 or later. Apply vendor mitigation XML as interim measure.",
  "fixVersion": "9.1R18"
}

Error Handling

Common Errors

Best Practices

1. Prioritize by EPSS - Sort vulnerabilities by EPSS score, not just CVSS severity
2. Focus on exploit maturity - ACTIVE and WEAPONIZED vulnerabilities need immediate attention
3. Scope to clients - Always filter by site when reviewing a specific client's vulnerability posture
4. Track remediation - Monitor status transitions from NEW to RESOLVED over time
5. Use risk acknowledgment wisely - Only use RISK_ACKED for vulnerabilities with genuine compensating controls
6. Generate client reports - Build severity-based summaries for client QBRs
7. Monitor for new criticals - Regularly check for new CRITICAL/HIGH vulnerabilities with high EPSS
8. Group patches by application - Prioritize patches that fix the most high-EPSS vulnerabilities
9. Check notes and history - Review existing notes before duplicating investigation work
10. Cross-reference with alerts - Check if any vulnerability has associated exploitation alerts

Related Skills

• Alerts - Alert context for exploited vulnerabilities
• Misconfigurations - Security posture gaps related to vulnerabilities
• Inventory - Asset context for affected endpoints
• API Patterns - MCP tools reference and connection info
• Purple AI - Investigate exploitation of specific CVEs