Auto-investigate unresolved SentinelOne threats and open Jira cases
Build a scheduled workflow that queries SentinelOne for unresolved threats. For each, gather detail, deduplicate against existing incidents and open Jira issues, and create a Jira case for genuinely new threats with the evidence attached. Paginate the threat list, handle threats already ticketed, and retry API failures. Output the list of cases created and duplicates suppressed.
What this prompt builds
Pull unresolved SentinelOne threats, analyze and dedupe them, then open Jira cases for tracking.
The problem
Unresolved EDR threats pile up in SentinelOne and don't reliably become tracked, owned work, so real detections go unactioned. Duplicate alerts also create noise that buries the important ones.
Solution and impact
This workflow pulls unresolved SentinelOne threats, analyzes each, deduplicates related incidents, and creates Jira cases. Detections become tracked tickets without an analyst manually polling the console.