List sites in the SentinelOne management console. In an MSP/MSSP console, sites are how clients are segmented — use this to discover the client list, then feed site IDs into the other tools. Returns name, state, licence counts (active/total), SKU/suite, expiration and health status per site.

Estate-wide endpoint health overview grouped by site — one call answers "what is the state of every client's endpoints?". Sweeps all agents server-side and returns a table per site: agent count, online/offline, infected, agents needing an update, reboot-required, stale agents (not seen for N days) and OS breakdown. This is the primary tool for MSP health/AV reporting. Use s1_agents to drill into the individual machines afterwards.

List endpoint agents with filters — the drill-down tool for machines. Returns each agent's computer name, site, OS, agent version, online/infected/up-to-date status, last active date, last logged-in user and network status. Filter by site, name, health flags or OS. Returns a compact summary per agent by default; set full_details=true for complete raw records (large). Call s1_list_sites first to resolve site IDs.

List threats/detections with filters — the drill-down tool for incidents. Returns each threat's name, classification, confidence level (malicious/suspicious), analyst verdict, incident status, mitigation status and actions, detection engine, file path/hash, affected machine and site, sorted newest first. Returns a compact summary per threat by default; set full_details=true for complete raw records. Use s1_threat_summary for aggregated counts across the estate.

Aggregated threat counts grouped by site — the reporting/dashboard tool. Sweeps ALL matching threats server-side and returns compact counts: per site by incident status, analyst verdict and classification, plus estate-wide totals, the most common threat names and the machines with the most detections. Ideal for "threats this month across all clients" reporting — pass created_after for the period. Use s1_threats to drill into individual detections afterwards.

Activity/audit log from the management console: threat mitigations, agent installs/upgrades, policy changes, user logins, exclusion changes and more, newest first. Useful as evidence of actions taken (e.g. "show what was done about the threat on machine X").